phishSimOverridePolicy

Phishing Simulation Policy. Lets approved phishing-simulation mail bypass filtering. The phishSimOverridePolicy entity set lives under /exchange/v1.0/phishSimOverridePolicy in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/phishSimOverridePolicy
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	ThreatPolicy.ReadWrite.All (Enterprise)
Backing cmdlets	Get-PhishSimOverridePolicy, Set-PhishSimOverridePolicy, New-PhishSimOverridePolicy, Remove-PhishSimOverridePolicy

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/phishSimOverridePolicy	List phishing-simulation override policies - the tenant-wide rules exempting 3rd-party simulation campaigns from Defender phish detection.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/phishSimOverridePolicy	Create a new phishSimOverridePolicy. Use ?dryRun=true to preview without committing.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/phishSimOverridePolicy/{key}	Get a single phishSimOverridePolicy by Identity. Returns 404 if absent.	ThreatPolicy.Read	Community
PATCH	/exchange/v1.0/phishSimOverridePolicy/{key}	Update a phishSimOverridePolicy’s mutable fields. Body carries only the fields to change.	ThreatPolicy.ReadWrite	Enterprise
DELETE	/exchange/v1.0/phishSimOverridePolicy/{key}	Remove a phishSimOverridePolicy. Use ?dryRun=true to preview without deletion.	ThreatPolicy.ReadWrite	Enterprise

GET /exchange/v1.0/phishSimOverridePolicy

List phishing-simulation override policies - the tenant-wide rules exempting 3rd-party simulation campaigns from Defender phish detection.

Backing cmdlet: Get-PhishSimOverridePolicy. Role: ThreatPolicy.Read (Community).

List phishSimOverridePolicy

Stub auto-generated example for the phishSimOverridePolicy collection. Backing cmdlet: Get-PhishSimOverridePolicy. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/phishSimOverridePolicy?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#phishSimOverridePolicy",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/phishSimOverridePolicy/{key}

POST /exchange/v1.0/phishSimOverridePolicy

Create a new phishSimOverridePolicy. Use ?dryRun=true to preview without committing.

Backing cmdlet: New-PhishSimOverridePolicy. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
name	body		yes
comment	body
enabled	body
dryRun	query	bool (switch)

Create rejected - missing required name

New-PhishSimOverridePolicy requires the name field. Omitting it fails body validation before the cmdlet is invoked and returns the canonical 400 error envelope.

POST /exchange/v1.0/phishSimOverridePolicy HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comment": "Exonaut 3rd-party phishing-simulation override",
  "enabled": true
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The 'name' field is required.",
    "target": "name"
  },
  "correlationId": "0HN7K3QF1A2BC:00000001"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/phishSimOverridePolicy

Create a phishing-simulation override policy

Creates a 3rd-party phishing-simulation override policy by invoking New-PhishSimOverridePolicy. The policy container is paired with phishSimOverrideRules that carry the actual sender IP ranges and domains.

POST /exchange/v1.0/phishSimOverridePolicy HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-phishSimOverridePolicy",
  "comment": "Exonaut 3rd-party phishing-simulation override",
  "enabled": true
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/phishSimOverridePolicy/exonaut-sample-phishSimOverridePolicy

{
  "Id": "exonaut-sample-phishSimOverridePolicy",
  "Identity": "exonaut-sample-phishSimOverridePolicy",
  "Name": "exonaut-sample-phishSimOverridePolicy",
  "Comment": "Exonaut 3rd-party phishing-simulation override",
  "Enabled": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/phishSimOverridePolicy

GET /exchange/v1.0/phishSimOverridePolicy/{key}

Get a single phishSimOverridePolicy by Identity. Returns 404 if absent.

Backing cmdlet: Get-PhishSimOverridePolicy. Role: ThreatPolicy.Read (Community).

Get a single phishSimOverridePolicy entry

Stub auto-generated example for GET /phishSimOverridePolicy/{key}. Backing cmdlet: Get-PhishSimOverridePolicy with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/phishSimOverridePolicy/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#phishSimOverridePolicy/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/phishSimOverridePolicy

PATCH /exchange/v1.0/phishSimOverridePolicy/{key}

Update a phishSimOverridePolicy’s mutable fields. Body carries only the fields to change.

Backing cmdlet: Set-PhishSimOverridePolicy. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
comment	body
enabled	body
dryRun	query	bool (switch)

Update a phishing-simulation override policy

Updates the mutable fields of a phishing-simulation override policy by invoking Set-PhishSimOverridePolicy. The body carries only the fields to change.

PATCH /exchange/v1.0/phishSimOverridePolicy/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comment": "Exonaut override - updated description",
  "enabled": false
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-phishSimOverridePolicy",
  "Identity": "exonaut-sample-phishSimOverridePolicy",
  "Name": "exonaut-sample-phishSimOverridePolicy",
  "Comment": "Exonaut override - updated description",
  "Enabled": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/phishSimOverridePolicy

DELETE /exchange/v1.0/phishSimOverridePolicy/{key}

Remove a phishSimOverridePolicy. Use ?dryRun=true to preview without deletion.

Backing cmdlet: Remove-PhishSimOverridePolicy. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Delete a phishing-simulation override policy

Removes a phishing-simulation override policy by invoking Remove-PhishSimOverridePolicy. Returns 204 No Content on success.

DELETE /exchange/v1.0/phishSimOverridePolicy/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/phishSimOverridePolicy

?dryRun=true previews of any write stay on Community.