Multiple Phish Alert Button Instances (Multi-PAB): Microsoft 365 or Exchange

The below instructions explain how to set up multiple Phish Alert Button (PAB) instances in Exchange or Microsoft 365. For an overview of why you may want to use multiple instances of the PAB, see this page.

1. Follow the instructions on our main Multiple PAB Instances article to add additional PAB instances under your KnowBe4 Account Settings.
   1. Remember to name each PAB instance uniquely under Setting Name.
   2. Add an email address to forward non-simulated phishing emails to.
   3. You can also expand the language tab to customize the forwarded email prefix, confirmation text, and messages if desired.
   4. Download the PhishAlertManifest.xml file.
2. Rename each .xml file to be similar to the corresponding PAB instance's Setting Name as you defined in your Account Settings. This will help to distinguish it from the other PAB instances you are setting up.
3. Right-click to edit the .xml file. Modify the Display Name field (the area between the quotation marks in the screenshot below).We recommend that you set the Display Name to match the corresponding PAB instance's Setting Name you defined in your Account Settings. Save your file.
4. Repeat steps 2 and 3 for each .xml file you downloaded.
5. Navigate to your mail server Admin portal. Click on Services & add-ins> + Deploy Add-In > I have the manifest file (.xml) on this device.
6. Click Next then select who has access and which deployment method you would like to use. We recommend that you make the add-in accessible to Everyone and to use the Fixed deployment method.
   Note: If you having trouble deploying the PAB to certain groups, please disable the " the new admin center" toggle.

   
7. Click Deploy Now.
8. Assign your users to unique Distribution Lists on Exchange/Microsoft 365, with each Distribution List corresponding to a specific PAB instance.
   1. From your mail server Admin portal, click on Groups, then Groups.
   2. Click the +Add a group button to create a Distribution List for each unique PAB instance. Make sure to add a name and an email address that corresponds to the specific PAB instance to which you want to associate the Distribution List.
   3. Assign users to the appropriate Distribution Lists by selecting the Distribution List and selecting the Edit button next to the Members field. Then click + Add members.
      Important:If users are assigned to more than one Distribution List, they will see multiple Phish Alert Buttons.
      
9. Once each version of the PAB is installed on an Exchange account, admins can assign each App to specific users per the following method: 
   1. Open PowerShell/Exchange Shell (run as admin), connect to Exchange/Microsoft 365 by running these commands:$UserCredential = Get-CredentialEnter your credentials.$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic –AllowRedirectionImport-PSSession $Session
      Note: This method is described on: TechNet: Connect to Exchange Online PowerShell
   2. Copy the PAB App ID from within the .xml file (the <Id> field).
   3. Assign each PAB App to specific users. Enter the following commands:$a = Get-DistributionGroupMember <GroupName>For example: $a = Get-DistributionGroupMember PAB_1# Assigns group members to variable $aSet-app <App ID for specific PAB install> -OrganizationApp -ProvidedTo SpecificUsers -UserList $a.IdentityFor example, Set-app c5c92d69-3fcd-4198-a18d-931916275e7e -OrganizationApp -ProvidedTo SpecificUsers -UserList $a.Identity
10. Repeat steps 5 - 7 for each PAB instance.
11. To verify this worked, run the following command:Get-App -OrganizationApp| Format-List DisplayName,AppId,Enabled,Default*,ProvidedTo,UserList
    Note: This method is described on: Microsoft Exchange Get-App. The commands, modifiers, and any requested inputs are not case sensitive.
12. Once this is done, you can who has access to each Phish Alert add-in instance by selecting the specific instance in your Admin Center and looking in the Who has access? field.

    

13. Ensure each Phish Alert instance has a status of On and that the correct deployment method is selected.
    Note: It can take up to an hour for the Phish Alert add-in to appear in your users' mail clients.