If you have followed KnowBe4's advice and set up the Advanced Delivery Policy (ADP) as documented in this article (https://support.knowbe4.com/hc/en-us/articles/4404511190803-Advanced-Delivery-Policies-in-Microsoft-Defender), then you’ll likely see in Microsoft 365 message tracking that the simulation emails arrive in Microsoft 365 and successfully go across to the Defend console. However, when emails come back, they are quarantined.

The reason for this process is that the ADP lists specific IP addresses and domains from which the simulation emails are sent, and the Defend IP address is not listed there.

Microsoft Advanced Delivery Policy Configuration

To avoid phishing simulation tests from being quarantined, add Defend’s sending IP addresses to an advanced delivery in Microsoft 365. All of Defend’s regional sending IP addresses can be found below: