phishSimOverrideRules

Phishing Simulation Rules. Defines which simulation senders and URLs are allowed through. The phishSimOverrideRules entity set lives under /exchange/v1.0/phishSimOverrideRules in the Threat protection category.

Fact	Value
Path	`/exchange/v1.0/phishSimOverrideRules`
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	`ThreatPolicy.Read.All` (Community)
Write role	`ThreatPolicy.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-ExoPhishSimOverrideRule, Set-ExoPhishSimOverrideRule, New-ExoPhishSimOverrideRule, Remove-ExoPhishSimOverrideRule

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/phishSimOverrideRules`	List phishSimOverrideRules - the sender domain + IP-range exemptions attached to a phishSimOverridePolicy.	`ThreatPolicy.Read`	Community
POST	`/exchange/v1.0/phishSimOverrideRules`	Create a phishSimOverrideRule attached to the phishSimOverridePolicy. Body lists sender domains + IP ranges to exempt.	`ThreatPolicy.ReadWrite`	Enterprise
GET	`/exchange/v1.0/phishSimOverrideRules/{key}`	Get a single phishSimOverrideRule by Identity. Returns 404 if absent.	`ThreatPolicy.Read`	Community
PATCH	`/exchange/v1.0/phishSimOverrideRules/{key}`	Partial update via Set-ExoPhishSimOverrideRule. Use delta-style addDomains/removeDomains/addSenderIpRanges/removeSenderIpRanges params for list updates.	`ThreatPolicy.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/phishSimOverrideRules/{key}`	Remove a phishSimOverrideRule. Use ?dryRun=true to preview without deletion.	`ThreatPolicy.ReadWrite`	Enterprise

GET /exchange/v1.0/phishSimOverrideRules

List phishSimOverrideRules - the sender domain + IP-range exemptions attached to a phishSimOverridePolicy.

Backing cmdlet: Get-ExoPhishSimOverrideRule. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
`policy`	query	string		Scope to rules under a specific phishSimOverridePolicy (policy Name, Id, DN, or GUID).

List phishSimOverrideRules

Stub auto-generated example for the phishSimOverrideRules collection. Backing cmdlet: Get-ExoPhishSimOverrideRule. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/phishSimOverrideRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#phishSimOverrideRules",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/phishSimOverrideRules

Create a phishSimOverrideRule attached to the phishSimOverridePolicy. Body lists sender domains + IP ranges to exempt.

Backing cmdlet: New-ExoPhishSimOverrideRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required
`policy`	body		yes
`senderIpRanges`	body		yes
`comment`	body
`domains`	body
`name`	body
`dryRun`	query	bool (switch)

Create rejected - missing required senderIpRanges

New-ExoPhishSimOverrideRule requires both policy and senderIpRanges. Omitting senderIpRanges fails body validation before the cmdlet is invoked and returns the canonical 400 envelope.

POST /exchange/v1.0/phishSimOverrideRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "policy": "PhishSimOverridePolicy",
  "name": "exonaut-sample-phishSimOverrideRules",
  "comment": "EXONAUT sample missing the required senderIpRanges field."
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The field 'senderIpRanges' is required.",
    "target": "senderIpRanges"
  },
  "correlationId": "0HN3VK2P9Q7AB:00000003"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create a phishing-simulation override rule

Creates a phishSimOverrideRule via New-ExoPhishSimOverrideRule, attaching sender IP ranges and domains that should be exempted from phishing detection for a 3rd-party simulation campaign. Requires the parent phishSimOverridePolicy (Policy) and at least one SenderIpRanges entry.

POST /exchange/v1.0/phishSimOverrideRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "policy": "PhishSimOverridePolicy",
  "senderIpRanges": [
    "192.0.2.0/24",
    "198.51.100.10"
  ],
  "domains": [
    "contoso.com",
    "phishsim.contoso.com"
  ],
  "name": "exonaut-sample-phishSimOverrideRules",
  "comment": "EXONAUT sample: exempt 3rd-party phishing-simulation senders."
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/phishSimOverrideRules/exonaut-sample-phishSimOverrideRules

{
  "Id": "exonaut-sample-phishSimOverrideRules",
  "Identity": "exonaut-sample-phishSimOverrideRules",
  "Name": "exonaut-sample-phishSimOverrideRules",
  "Policy": "PhishSimOverridePolicy",
  "SenderIpRanges": [
    "192.0.2.0/24",
    "198.51.100.10"
  ],
  "Domains": [
    "contoso.com",
    "phishsim.contoso.com"
  ],
  "Comment": "EXONAUT sample: exempt 3rd-party phishing-simulation senders."
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

GET /exchange/v1.0/phishSimOverrideRules/{key}

Get a single phishSimOverrideRule by Identity. Returns 404 if absent.

Backing cmdlet: Get-ExoPhishSimOverrideRule. Role: ThreatPolicy.Read (Community).

Get a single phishSimOverrideRules entry

Stub auto-generated example for GET /phishSimOverrideRules/{key}. Backing cmdlet: Get-ExoPhishSimOverrideRule with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/phishSimOverrideRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#phishSimOverrideRules/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

PATCH /exchange/v1.0/phishSimOverrideRules/{key}

Partial update via Set-ExoPhishSimOverrideRule. Use delta-style addDomains/removeDomains/addSenderIpRanges/removeSenderIpRanges params for list updates.

Backing cmdlet: Set-ExoPhishSimOverrideRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type
`addDomains`	body
`addSenderIpRanges`	body
`comment`	body
`removeDomains`	body
`removeSenderIpRanges`	body
`dryRun`	query	bool (switch)

Update a phishing-simulation override rule

Sub-resource update of the rule retrieved at GET /phishSimOverrideRules/{key} - partial update via Set-ExoPhishSimOverrideRule. List fields use delta-style addDomains/removeDomains and addSenderIpRanges/removeSenderIpRanges params rather than full replacement.

PATCH /exchange/v1.0/phishSimOverrideRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comment": "EXONAUT sample: updated exemption note.",
  "addDomains": [
    "sim2.contoso.com"
  ],
  "addSenderIpRanges": [
    "203.0.113.0/24"
  ]
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-phishSimOverrideRules",
  "Identity": "exonaut-sample-phishSimOverrideRules",
  "Name": "exonaut-sample-phishSimOverrideRules",
  "Policy": "PhishSimOverridePolicy",
  "SenderIpRanges": [
    "192.0.2.0/24",
    "198.51.100.10",
    "203.0.113.0/24"
  ],
  "Domains": [
    "contoso.com",
    "phishsim.contoso.com",
    "sim2.contoso.com"
  ],
  "Comment": "EXONAUT sample: updated exemption note."
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/phishSimOverrideRules/{key}

Remove a phishSimOverrideRule. Use ?dryRun=true to preview without deletion.

Backing cmdlet: Remove-ExoPhishSimOverrideRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete a phishing-simulation override rule

Sub-resource removal of the rule retrieved at GET /phishSimOverrideRules/{key} - deletes the phishSimOverrideRule via Remove-ExoPhishSimOverrideRule. Returns 204 No Content on success. Use ?dryRun=true to preview without deleting.

DELETE /exchange/v1.0/phishSimOverrideRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.