Direct Message Injection for Microsoft 365

Direct Message Injection (DMI) places simulation messages straight into a Microsoft 365 mailbox through the Microsoft Graph API instead of sending them over SMTP. Because the message never travels the inbound mail path, it is not touched by spam filtering, antivirus scanning or transport rules, so a simulation reaches the inbox exactly as it was designed.

Use DMI when allow-listing the Cyberdise sending infrastructure in Exchange Online is impractical, or when transport rules keep rewriting or quarantining simulations.

What you need

• A Microsoft Entra ID (Azure AD) tenant holding the target mailboxes.
• Permission to register an application and to grant admin consent.
• Mailboxes hosted in Exchange Online. On-premises mailboxes cannot be injected into —

use SMTP delivery for those.

1. Register the application in Entra ID

1. In the Microsoft Entra admin center open App registrations → New registration.
2. Give it a name, for example Cyberdise DMI, and register it.
3. Note the Application (client) ID and the Directory (tenant) ID.

2. Grant the Graph permission

1. Open API permissions → Add a permission → Microsoft Graph → Application permissions.
2. Select Mail.ReadWrite.
3. Select Grant admin consent. The permission must show *Granted* before DMI will work.

Restrict the scope. Mail.ReadWrite as an application permission grants access to every mailbox in the tenant. Microsoft's application access policies let you limit the app to a single mail-enabled security group. Create a group containing only the users in scope for awareness campaigns and bind the application to it before you enable DMI in production.

3. Create a client secret

Open Certificates & secrets → New client secret, copy the *value* immediately — it is shown only once — and record its expiry date so you can rotate it in time.

4. Add the application to Cyberdise

1. Go to Advanced → Settings → Integrations → Azure Apps.
2. Select Add Azure App and fill in Name, Client Id, Client Secret and Tenant Id.
3. Save.

5. Switch a module to Direct Message Injection

DMI is chosen per module, so you can mix it with ordinary sending inside one campaign.

1. Open the campaign, go to Modules and edit the module.
2. On the Details tab set Email Delivery Method to Direct Message Injection (Microsoft 365).
3. Save.

The other delivery methods remain available on the same dropdown:

What to expect

• Messages appear in the recipient's Inbox, not in Drafts.
• Spam filtering, antivirus and transport rules are bypassed.
• Delivery failures are written to the message log of the campaign

(Schedule → Display Message Log).

Troubleshooting