Set Up SpamFoo for Microsoft 365

SpamFoo for Microsoft 365 checks the mail in your Exchange Online mailboxes. SpamFoo runs it for you, so there is nothing to install. You connect your Microsoft 365 organization from your SpamFoo account, then choose which mailboxes SpamFoo protects and what it does with mail.

Before You Start

• Have a SpamFoo for Microsoft 365 license.
• Have a Microsoft 365 administrator account. To connect the whole organization, use a Global Administrator or Privileged Role Administrator account.

You can connect Microsoft 365 while SpamFoo is still setting up your instance. Mailboxes are protected once the instance is ready, and SpamFoo emails you when it is.

Open the Microsoft 365 Page

1. Sign in to your account at www.spamfoo.com and open your Microsoft 365 license.
2. Click Microsoft 365 Settings.

Connect Microsoft 365

The Connect Microsoft 365 card offers two ways to give SpamFoo access:

• Whole organization: an administrator approves SpamFoo for every mailbox. You still choose which mailboxes SpamFoo protects in the next step.
• Selected mailboxes: Exchange Online limits SpamFoo to a group or administrative unit you choose. Use this if SpamFoo should only ever reach certain mailboxes.

Connect the Whole Organization

1. Choose Whole organization.
2. Click Connect with Microsoft and approve the permissions SpamFoo asks for.
3. When Microsoft asks you to sign in again, sign in with the same administrator account. SpamFoo uses it to confirm which organization you manage.

The page shows Microsoft 365 is connected when it worked.

Connect Selected Mailboxes

1. Choose Selected mailboxes.
2. Click Sign in with Microsoft and sign in as an administrator.
3. Run the Microsoft Graph PowerShell command the page shows. It lets SpamFoo list your users.
4. Put the mailboxes to protect in a group named SpamFoo Protected, then run the Exchange Online PowerShell commands the page shows.
5. Wait for Exchange to apply the change, which can take up to 2 hours. Then enter one mailbox address and click Test access.

Choose Mailboxes and a Mode

On the Mailboxes and Mode card:

1. Under Protected mailboxes, choose All licensed users or pick Selected mailboxes from the list.
2. Under What SpamFoo does with mail, choose a mode.
3. Click Save Settings. The connector applies them within a few minutes.

The modes are:

• Shadow: classifies mail and reports what it would do, without changing any mailbox. Start here to see SpamFoo's results first.
• Junk only: moves spam and phishing to the Junk Email folder.
• Junk and categories: moves spam and phishing to Junk and adds a category, such as Updates, to other mail.

Your plan decides which modes you can choose. The same card can also turn on Send a welcome message, which puts a one-time message in each protected mailbox's Inbox with a link to the SpamFoo dashboard.

Check That It Works

The Status card shows the connection, the number of protected mailboxes, and counts for the last 24 hours, such as messages classified and moved to Junk. In shadow mode it also shows how many messages SpamFoo would have moved.

Give Users Their Dashboard

Your users see how SpamFoo handled their mail at www.spamfoo.com/m365/dashboard. They sign in with their Microsoft 365 work account, and only people whose mailbox SpamFoo protects can open it. For what the dashboard shows, see Open Your Dashboard.

To make the dashboard easy to find, add it to the Microsoft 365 app launcher as a custom tile. The Add SpamFoo to the Microsoft 365 App Launcher card on the Microsoft 365 page lists the steps:

1. Sign in to the Microsoft 365 admin center as an admin.
2. Select Show all, then Settings, then Org settings.
3. On the Organization profile tab, select Custom tiles for Apps, then Add a custom tile.
4. Enter SpamFoo as the tile name and paste the dashboard address as the website URL. Add an image URL for a 60 by 60 pixel image anyone can open, and a short description.
5. Select Save.

The tile can take up to 24 hours to appear on the All tab of the app launcher.

Disconnect Microsoft 365

Click Disconnect on the Microsoft 365 page. SpamFoo stops protecting the mailboxes, removes its mail subscriptions, and deletes the data it keeps for your organization. Mail that SpamFoo already moved stays where it is. The SpamFoo app stays in your organization until you delete it in the Microsoft Entra admin center under Enterprise applications.

Troubleshooting

Microsoft 365 Was Not Connected

Test Access Is Denied