Direct Message Injection (DMI)
Direct Message Injection (DMI) for Engage is a secure integration that allows simulated phishing emails to be delivered directly into users’ inboxes within Microsoft 365 or Google Workspace environments. By leveraging official APIs, DMI bypasses traditional email filtering and allowlisting, ensuring reliable delivery of your simulated phishing campaigns.
How DMI Integrates with Google and Microsoft
Google Workspace Integration
- Mechanism: DMI leverages the Gmail API with domain-wide delegation, allowing authorized applications to insert messages directly into users’ inboxes.
- Setup: Requires Google Workspace Super Admin access, OAuth client registration, and the granting of specific API scopes (e.g., https://www.googleapis.com/auth/gmail.insert).
- Benefits: Bypasses spam filters, eliminates the need for IP whitelisting, and ensures fast, reliable delivery.
Microsoft 365 Integration
- Mechanism: DMI uses Microsoft Graph API to inject messages directly into Exchange Online mailboxes.
- Setup: Our set up process is automated via the OAuth consent flow.
- Benefits: No need for IP whitelisting, improved delivery rates, and simplified setup. However, post-delivery security tools (like Microsoft Defender) may still process injected emails.
Key Features
- Guaranteed Delivery: Phishing simulations are delivered directly to inboxes, bypassing traditional filters and reducing the risk of being marked as spam or missed.
- Operational Efficiency: DMI simplifies the onboarding process for security awareness programs. It reduces administrative overhead by eliminating complex whitelisting, saving time for IT and security teams.
- Flexible Control: Administrators can enable or disable DMI as needed on a per campaign basis, providing full control over how phishing simulations are delivered.
- User-Level Delivery Tracking: Gain visibility into the delivery status of phishing simulations for each user through DMI, enabling precise monitoring and reporting.
- Security and Compliance: Uses secure, authenticated API connections, with granular control over permissions and access.
- Scalability: Supports large-scale deployments across enterprise environments, with centralized management and monitoring.
Considerations
- Phishing vs. Training Emails: While DMI ensures phishing simulation emails are delivered, training notifications and other email notifications will follow traditional email delivery mechanisms and may require additional allowlisting.
- Permissions: DMI requires specific permissions within your Microsoft 365 or Google Workspace environment to function securely and effectively.
- Security: All connections are encrypted and follow best practices for data privacy and security.
