The Hybrid Phish Alert Button (PAB) for Microsoft 365 allows your users to easily report suspicious emails and help protect your organization from cyberattacks. When your users click the PAB to report an email, they can provide your IT team with an early warning about potential threats.
The Hybrid PAB detects your users’ mail clients and automatically configures the best version of the PAB for each user. To learn how to install the Hybrid PAB and how your users can use the PAB in their mail clients, see the sections below.
Prerequisites and Limitations
Before you can install the Hybrid PAB for your organization, your organization will need to have one of the following mail environments:
- Microsoft 365
- Microsoft Outlook 2021 or later for Mac
If you have a proxy server, a connection to the following is needed to bypass the proxy server or proxy authentication:
- outlook.office365.com
- outlook.office.com
- us.pab.knowbe4.com, eu.pab.knowbe4.com, or ca.pab.knowbe4.com
The domain used will depend on where your KnowBe4 account is located.
You will also need to enable and configure the PAB from your KnowBe4 console Account Settings before following the steps in this article. To learn how to enable and configure the PAB in your KnowBe4 account, see the Enable PAB section of our Phish Alert Button (PAB) Product Manual.
Installing the Hybrid PAB for Microsoft 365
To install the Hybrid PAB in Microsoft 365, follow the steps below:
Accepting Required Permissions
Before installing the Hybrid PAB for Microsoft 365, follow the steps below:
- Log in to your KnowBe4 console.
- Select your email address in the top-right corner of the page, and select Account Settings.
- Navigate to Account Integrations > Phish Alert.
- Select the Enable Phish Alert check box.
- From the Select PAB Version drop-down menu, select Hybrid PAB.
-
Select Accept Microsoft Permissions to Authorize GRAPH APIs for the PAB. You will be redirected to the Microsoft 365 login page.
- Log in to your Microsoft 365 account using your admin credentials.
-
Once you log in, the Permissions requested pop-up window will display. Read the permissions, then select Accept.
-
Once you accept the permissions, the GRAPH Authorization Successful window will display. Select Back to PAB Configuration to return to the Phish Alert settings.
- Select Authorize NAA-SSO for GRAPH APIs and repeat steps 6 through 9.
Installing the Hybrid PAB for Microsoft 365
Follow the steps below to install the Hybrid PAB for Microsoft 365:
-
Select the download icon next to the PAB manifest for Microsoft products option to download the PhishAlertManifest.xml file.
Note:Each Phish Alert Button (PAB) XML manifest file is unique to the KnowBe4 console based on where it's downloaded. So, if you manage multiple KnowBe4 consoles, you'll need to download and install the correct manifest file for each console separately. - In a new tab of your browser, log in to your Microsoft 365 admin center.
- From the menu on the left side of the page, select Settings.
-
From the Settings drop-down menu, select Integrated apps.
-
Select Upload custom apps in the middle of the page. The Deploy New App page will open.
-
On the Deploy New App screen, select Office Add-in from the App type drop-down menu. In the Upload manifest file (.xml) from device section, click Choose File and select the PhishAlertManifest.xml file.
- Click Next.
-
Select which users will have access to the PAB and click Next.
Important:We recommend allowing all users to access the PAB.
-
Read the permissions requested and click Accept permissions to continue.
- Click Next.
-
Click Finish deployment.
Installing to Shared Mailboxes
The Hybrid PAB supports installation for shared mailboxes shared mailboxes (link opens in new window). This feature requires that Graph API and Nested App Authentication single sign-on (NAA-SSO) permissions are authorized in your Microsoft 365 tenant. See steps 6 through 10 in the Accepting Required Permissions section above for instructions on how to authorize these permissions.
Prerequisites for Shared Mailbox Installation
Make sure you meet the requirements below to install the PAB for a shared mailbox:
- Your mail environment must support the Outlook add-in API requirement set 1.8 Outlook add-in API requirement set 1.8 (link opens in new window).
-
The PAB XML manifest you are using must have the following line: <SupportsSharedFolders>true</SupportsSharedFolders>
Hybrid PAB User Experience
Once installed, the Hybrid PAB will automatically detect your users’ mail clients and configure the best PAB for each user. The user experience will be different for each user depending on their specific mail client.
Outlook on the Web User Experience
In Microsoft Outlook on the web, add-ins deployed in integrated apps from the Microsoft 365 admin center are automatically pinned in the ribbon. For more information about managing add-ins, visit Microsoft's Get an Office Add-in for Outlook Get an Office Add-in for Outlook (link opens in new window) article.
You can select the Phish Alert Button, which appears in the ribbon. You can also access the Phish Alert Button in the Apps launcher by selecting the Apps icon in the top-right corner of an open email.
If the PAB does not display in the Apps launcher, you can select Add apps to open the Apps Store. From the Apps drop-down menu, select the Built for your org subtab to view the optional add-ins that your organization has approved. If the PAB add-in is available, you can select Phish Alert and select Add. Then, the PAB will display in the Apps launcher.
Classic Outlook Client User Experience
In the classic version of Microsoft Outlook for Windows, you can select the Phish Alert button in the Home tab of the toolbar at the top of an open email. Then, the PAB will display in the toolbar on the right side of the email.
Microsoft Outlook for Mac User Experience
In Microsoft Outlook for Mac, you can select the PAB add-in that displays in the toolbar on the right side of the page. You can also find the PAB by selecting the ellipsis icon (...) in the toolbar at the top of an open email. To pin the PAB add-in to the toolbar, select the Customize actions button.
Your users can select the PAB in any of these mail clients to report suspicious emails. When a user reports a non-simulated phishing email, the PAB removes it from their inbox. If your organization has an address entered in the Send Non-Simulated Emails to field, the PAB also forwards a copy to that address and moves the reported email to the user's Sent Items folder. If a user incorrectly reports an email, they can retrieve it from their Deleted Items folder or Trash folder.
Updating and Uninstalling the Hybrid PAB
This section shows how to uninstall the Hybrid PAB for your organization. If you need to redeploy the PAB XML manifest file, we recommend first removing your existing PAB installation.
Updating the Hybrid PAB for Microsoft 365
To update the Hybrid PAB for Microsoft 365, follow these steps:
- Log in to your KnowBe4 console.
- Select your email address in the top-right corner of the page, and select Account Settings.
- Navigate to Account Integrations > Phish Alert.
- From the Select PAB Version drop-down menu, select Hybrid PAB.
- Select the download icon next to the PAB manifest for Microsoft products option to download the PhishAlertManifest.xml file.
- Go to Settings > Integrated Apps > Add-ins in your Microsoft 365 admin center Microsoft 365 admin center (link opens in new window).
- Find your PAB add-in in the list.
- Select the add-in and select Update add-in.
- Upload your updated PhishAlertManifest.xml file.
Uninstalling the Hybrid PAB for Microsoft 365
To uninstall the Hybrid PAB for Microsoft 365, follow these steps:
- Go to Settings > Integrated Apps > Add-ins in your Microsoft 365 admin center Microsoft 365 admin center (link opens in new window).
- Find your PAB add-in in the list.
- Select the add-in and select Remove Add-In.