Phishing Simulation

Email Reporting Pilot: Install, Connect and Use

Availability: Gmail and Outlook pilot artifacts, version 1.1.0. A Marketplace update and Outlook store release have not yet been verified. Your administrator supplies the approved installation or sideload package. Mobile clients, shared mailboxes and on-premises Exchange are not yet verified.

Administrator setup

Use the existing approved Gmail Marketplace listing and install for a pilot group or organisational unit. For Outlook, host the complete task pane on the approved HTTPS origin, validate the generated manifest, then deploy through your Microsoft admin process. A localhost manifest is for testing only.

Verify reporting intake and triage in the selected workspace. Configure the exact tracker HTTPS origin for simulation credit. Test a real message and a simulation in the actual client before expanding the pilot. Hunto workspaces with PhishGrid installed use its triage queue; direct Monitor incident creation is not available.

Connect your account

In the app select the workspace, open Channels → Email reporting, and create a personal connection. Copy its URL and token. The token expires after 30 days. Each person needs their own token; never share it or use the server API key.

In Gmail open Settings and enter the URL and token. In Outlook enter them in the task pane and connect for the current session. Closing the Outlook pane clears its connection. Access to the setup page depends on workspace role policy; contact your administrator if unavailable. Automatic managed enrollment is not available yet.

Report an email

Open a saved message and choose Report. The message stays in the inbox. Confirmation means the workspace accepted a durable report. Repeating the action returns the same receipt. The server attributes recognised simulations; other messages enter triage.

The pilot sends sender, subject, message ID, selected headers and up to 20,000 plain-text characters. It does not transfer raw MIME or attachments. The add-in never opens suspicious links.

Resolve a failed report

  • Not connected: check the reporting URL and personal token.
  • Expired or revoked: create a new connection in the correct workspace.
  • Not sent: check connectivity and retry. Failures are never shown as accepted.
  • No campaign credit: the tracker origin, workspace or recipient could not be verified; the message can still enter triage.
  • Copy unavailable: use a secure browser context and copy the token field manually.

Revoke connections when no longer needed. Removing the add-in does not revoke a server token; administrators should verify both during offboarding.