Avanan Administration Guide

Important Information

Related Documents

Introduction to Avanan

Getting Started

Accessing the Avanan Administrator Portal

Portal Identifier of Avanan Tenant

Licensing the Avanan Product

Managing Avanan Licenses

Limiting License Consumption and Security Inspection to a Specific Group

Manual Changes to License Assignment

Trial Period for Avanan in the Check Point Portal

Activating SaaS Applications

Minimum License Requirements to Activate SaaS Applications

Activating Office 365 Mail

Office 365 Mail - Required Roles and Permissions

Required Application Roles

Reducing the Assigned Microsoft Application Role

Automatic Mode Onboarding - Microsoft 365 Footprint

Mail Flow Rules (Transport Rules)

Avanan - Protect Outgoing Rule

Avanan - Protect Internal Rule

Avanan - Protect Rule

Avanan - Whitelist Rule

Avanan - Junk Filter Low Rule

Avanan - Junk Filter Rule

Avanan- Encryption

Avanan Inbound Connector

Avanan DLP Inbound Connector

Avanan Internal Inbound Connector

Avanan Outbound Connector

Avanan DLP Outbound Connector

Avanan Journaling Outbound Connector

Connection Filters

Distribution Lists

Spoofed Senders Allow List

Trusted ARC Sealers

Reported Phishing Emails

Delegated Token

PowerShell Scripts

Connecting Multiple Portals to the Same Microsoft 365 Account

Connecting Multiple Avanan Tenants

Connecting Multiple Tenants to the same Microsoft 365 Account - Microsoft 365 Footprint

Deactivating Office 365 Mail

Activating Microsoft Teams

Activating Office 365 OneDrive

Activating Office 365 SharePoint

Activating Google Workspace (Gmail and Google Drive)

Activating Gmail

Activating Google Drive

Google Workspace Footprint

Changing the Google Application Role

Performing Actions on Behalf of Users

Inbound Gateway

SMTP Relay Service

Content Compliance Rules

Google Drive Permissions Changes

Activating Slack

Onboarding Next Steps

Migrating from an Avanan Portal to a Check Point Portal

Migration Steps

Accessing the Check Point Portal

User Management and Access to the Avanan Portal

Configuring Security Engines

Anti-Phishing (Smart-Phish)

Anti-Malware(Check Point SandBlast)

Data Loss Prevention (SmartDLP)

Creating a Custom Regular Expression DLP Data Type

Validating Regular Expression

Dictionary DLP Data Types

Compound DLP Data Types

Creating a Custom Compound DLP Data Type

Other Custom Data Types

Configuring Advanced Data Type Parameters

Configuring DLP Engine Settings

Storage of Detected Strings

Minimal Likelihood

Click-Time Protection

Configuring Click-Time Protection Engine

Rewritten Avanan URL

Hiding Original URL Full Path

Obfuscation and Validity of Rewritten URLs

Replacing Links Inside Attachments - Supported File Types

Click-Time Protection Against Malicious Files Behind Links

Click-Time Protection - End-User Experience

Email Protection

Office 365 Mail

Office 365 Mail Security Settings

Configuration Templates for Office 365 Mail

Protecting Microsoft 365 Groups

Adding a New Domain to Microsoft 365

Overriding Microsoft's False Positive Detections

Emails Falsely Quarantined by Microsoft

Emails Falsely Sent to Junk by Microsoft

Viewing Office 365 Mail Security Events

Viewing Security Events for Microsoft Quarantined Emails

Visibility into Microsoft Defender Verdict and Enforcement

Activating and Deactivating Gmail

Gmail Security Settings

Configuration Template Google Gmail

Viewing Gmail Security Events

Configuring Email Policy

Threat Detection Policy

Threat Detection Policy for Incoming Emails

Excluding Members of Microsoft 365 Groups from a Prevent (Inline) Policy

Manually Controlling IP Exceptions in Microsoft 365 Mail Flow Rules

When are my changes overridden

Threat Detection Policy for Outgoing Emails

Supported Workflow Actions

Prerequisites to Avoid Failing SPF Checks

Threat Detection Policy for Internal Emails

Inline Protection for Internal Emails (Office 365 Mail) - Manual Configuration Required

Fallback Workflows for Internal Traffic

Threat Detection Policy Workflows

Malware Protection

Phishing Protection

Customizing the Subject Prefix for Phishing Warning Emails

Configure the Subject Prefix

Password Protected Attachments Protection

Requesting Passwords from End Users - End-User Experience

Quarantine. User is alerted and allowed to restore the email workflow

Password Protected Attachments - Administrator Experience

Attachment Cleaning (Threat Extraction)

Configuring Attachment Cleaning (Threat Extraction) for Office 365 Mail or Gmail

Attachment Cleaning (Threat Extraction) Clean Attachments and Workflows

Threat Extraction Exceptions

Adding a Threat Extraction Allow-List Exception

Deleting a Threat Extraction Allow-List Exceptions

Attachment Cleaning (Threat Extraction) – File Types and Attachments

Viewing Emails with Cleaned Attachments

Sending the Unmodified Emails to End Users

Attachment Cleaning (Threat Extraction) - End-User Experience

Smart Banners for Non-Clean Emails

Supported Workflows for Smart Banners

Spam Protection

Trusted Senders

Automatic Trusted Sender and Block-List Management

Trusting Senders - End User Experience

Graymail Workflows

Graymail Dedicated Folder

Delivering Graymail Emails to the Dedicated Folder for Google Gmail

Deliver to Dedicated Folder - End User Footprint

Quarantined Emails - End-User Experience

Customizing Attachment Cleaning ( Threat Extraction ) Attachment Name

Customizing Attachment Cleaning (Threat Extraction) Message

Data Loss Prevention (DLP) Policy

Sync Times with Microsoft

Enhanced DLP Policy using Microsoft Purview Sensitivity Labels

Configure DLP Policy with File Type Criteria

Configuring Misdirected Email Prevention

Misdirected Emails Categories

Configuring the Maximum Alerts shown to the End Users

DLP Policy for Outgoing Emails

DLP Subject Regular Expression (Regex)

Add a regular expression condition to a DLP policy

Subject Regular Expressions Syntax

Unsupported Regex Patterns in DLP

DLP Workflows for Outgoing Emails

DLP Alerts for Outgoing Emails

Prerequisites to Avoid Failing SPF Checks

Outgoing Email Protection - Office 365 Footprint for DLP

DLP Policy Sensitivity Level

DLP Policy for Incoming Emails

DLP Workflows for Incoming Emails

DLP Alerts for Incoming Emails

Encrypting Outgoing Emails

Microsoft Encryption for Outgoing Emails

Encrypting Outgoing Emails using Avanan Email Encryption

Activating Avanan Email Encryption

Accessing Avanan Email Encryption Encrypted Emails

External Recipients Interacting with Emails Vaulted by Avanan Email Encryption

Storage of Emails by Avanan Email Encryption

Configuring Avanan Email Encryption Parameters

Emails Encrypted by Avanan Email Encryption - End User (External Recipient) Experience

To view the secured email, the external recipient must do these

Click-Time Protection Policy

Notifications and Banners

Sending Email Notifications to End Users

Customizing the From address for Email Notifications

Warning Banners

Warning banner samples

Attaching Smart Banners to Emails

Customizing Smart Banners

Enabling/Disabling Specific Smart Banners

Automatically Enabling New Smart Banners

Excluding Specific Sender Domains from Smart Banner

Adding Smart Banners to Allow-Listed Emails

Supported Smart Banners

Notification and Banner Templates - Placeholders

Email Archiving

Activating Email Archiving

Archived Emails

Customizing the Retention Period of Archived Emails

Viewing Archived Emails

Importing Emails to Archive

Exporting Emails from Archive

Support for S/MIME-Signed Emails

Messaging Apps Protection

Microsoft Teams

Required Permissions

Activating and Deactivating Microsoft Teams

Microsoft Teams Security Settings

Configuring Malware Policy for Microsoft Teams

Configuring DLP Policy for Microsoft Teams

Secured Microsoft Teams Messages

Unblocking Messages

Viewing Microsoft Teams Security Events

Activating and Deactivating Slack

Slack Security Settings

Configuring Malware Policy Slack

Configuring Malware Policy

Configuring DLP Policy for Slack

Configuring DLP Policy for Slack

Viewing Slack Security Events

File Storage Protection

Office 365 OneDrive

Activating and Deactivating Office 365 OneDrive

Office 365 OneDrive Security Settings

Configuring Malware Policy for Office 365 OneDrive

Configuring DLP Policy for Office 365 OneDrive

How to View OneDrive Security Events

File Cleaning (Threat Extraction) for Office 365 OneDrive and Office 365 SharePoint

Configuring File Cleaning (Threat Extraction) for Office 365 OneDrive or Office 365 SharePoint

Cleaned Office 365 OneDrive / Office 365 SharePoint Files

Restoring the Original File

Restoring Files that are Cleaned Multiple Times

Viewing Cleaned Files for Office 365 OneDrive and Office 365 SharePoint

Office 365 SharePoint

Activating Office 365 SharePoint

Deactivating Office 365 SharePoint

Office 365 SharePoint Security Settings

Configuring Microsoft Teams File Scanning for E1/E3 Tenants

Configuring Malware Policy for Office 365 SharePoint

Configuring DLP Policy for Office 365 SharePoint

Viewing SharePoint Security Events

File Cleaning for OneDrive and SharePoint

Configuring File Cleaning (Threat Extraction) for Office 365 OneDrive or Office 365 SharePoint

Cleaned Office 365 OneDrive / Office 365 SharePoint Files

Restoring the Original File

Restoring Files that are Cleaned Multiple Times

Viewing Cleaned Files for Office 365 OneDrive and Office 365 SharePoint

Configuring Microsoft Teams File Scanning for E1/E3 Tenants

Supported Protection Policies

Enabling Microsoft Teams File Scanning through OneDrive

Enabling Microsoft Teams File Scanning through SharePoint

Required Permissions

Activating Google Drive

Deactivating Google Drive

Google Drive Security Settings

Configuring Malware Policy for Google Drive

Configuring DLP Policy for Google Drive

Viewing Google Drive Security Events

Action on Files Placed in Vault

Vault Action in Externally Shared Drives

Handling DLP Detections on Externally Shared Drives

Shared Files from Unprotected Drives

Compromised Account (Anomaly) Detection

Compromised Accounts (Anomaly) Workflows

Supported Anomalies

Suspected Anomalies

Configuring Anomaly Detection Workflows

Automatically Blocking All Outgoing Emails

Configuring Settings for Specific Anomalies

Anomaly Exceptions

Partner Risk Assessment (Compromised Partners)

Cloud SMTP Relay

SMTP Relay Configuration Flow

Access the Domains Section

Configure a Domain

Configure DNS Records

Configure the SPF Record

Configure the DKIM Record

Re-checking DNS Records

Access the Relay Sources Section

Relay Sources Table

Configure a Relay Source

Activate Cloud Email Relay

Managing Domains and Relay Sources

Deleting a Domain

Disabling a Relay Source

Deliverability Reporting

Sender Domain Selection and DNS Requirements

Sender Domain Evaluation

Managing Security Exceptions

Security Engine Exceptions

Anti-Phishing Exceptions

Viewing Anti-Phishing Exceptions

Adding Anti-Phishing Exceptions (Allow-List or Block-List Rule)

Interaction between Avanan Allow-List and Microsoft 365 Allow-List

Overriding Microsoft / Google sending emails to Junk folder

Applying Microsoft Allow-List also to Avanan

Importing Allow-List or Block-List from External Sources

Deleting Anti-Phishing Exceptions

Anti-Malware Exceptions

Anti-Malware Block-List

Password-Protected Attachments Allow-List

Adding DLP Allow-List

Click-Time Protection Exceptions

Configure Click-Time Protection exceptions

Link Shorteners and Re-Directions

URL Reputation Exceptions

From the URL Reputation Exceptions page

From the Microsoft Teams / Slack message profile page

Threat Extraction Exceptions

Adding a Threat Extraction Allow-List Exception

Deleting a Threat Extraction Allow-List Exceptions

Trusted Senders - End-User Allow-List

Adding Trusted Senders

To upload a CSV file with trusted senders:

To edit the trusted senders

Global IoC Block List (IOC Management)

Accessing Global IoC Block List

Managing IoCs and IoC Feeds

Managing Security Events

Dashboards, Reports and Charts

Overview Dashboard

Security Widgets

Business Email Compromise (BEC)

Compromised Users

User Interaction

Security Events

Application Protection Health

Login Events Map

Avanan Flow Charts

Detection Flow Chart

Malicious Detections Chart

Analytics Dashboard

To view analytics for a SaaS application

Customizing the Analytics Dashboard using AI Copilot

Customize the Analytics dashboard using Infinity AI Copilot

Office 365 Email and Gmail

Office 365 OneDrive

Avanan's Approach to Shadow IT in Avanan

Shadow IT Dashboard and Events

Shadow IT severity classification

Shadow IT event actions

User Interaction Dashboard

User Interaction Dashboard Widgets

Extending the Time Frame of the Analytics

Security Checkup Report

Security Checkup Report Recipients

Generating a Security Checkup Report

Last 30 Days Security Checkup Report

Scheduling the Security Checkup Report

Configuring a Report Schedule

Default Weekly Report

Sending a Scheduled Report Immediately

Editing a Report Schedule

Deleting a Report Schedule

Reviewing Security Events

Accessing the Events

Filtering the Events

Acting on Events

Dismissing Events

Adding a Note to a Security Event

Attachment Preview

Previewing Email Attachments

Reviewing Phishing Events

Acting on Phishing Events

Post-delivery Email Recheck

Reviewing Malicious Links

Reviewing Malware Events

Acting on Malware Events

Automatic Ingestion of End User Reports

Retention of Security Events

Searching for Emails

Acting on Filtered Results in Mail Explorer

Creating and Saving a New Query

Filtering the Query Results

Updating the Query Details

Exporting a Query Results to your Email Address

Scheduling an Export of Query Results to your Email Address

Modifying the Query Columns

Performing Bulk Actions on Query Results

Quarantining a Query Results

Restoring a Query from Quarantine

Sending a Query Alerts and Reports to Users

Manually Sending Items to Quarantine

Remediating Compromised Accounts

Blocking a User Account

Resetting a User Account Password

Unblocking a Blocked User Account

Resetting Password and Unblocking a Blocked User Account

Monitoring and Auditing Actions on Users

System Settings

SIEM / SOAR Integration

Source IP Address

Configuring SIEM Integration

Extending Formats to Include Additional Information

Forwarding Logs in Syslog Format

Forwarding Audit Logs to SIEM

Supported Security Events for SIEM

SIEM Integration Field Mapping Reference

Forwarding Events to AWS S3

Configuring AWS S3 to Send Avanan Logs to Splunk

Recommended Configuration for known SIEM Platforms

Configuring Integration with Cortex XSOAR by Palo Alto Networks

CrowdStrike Integration

Step 1 - Create a CrowdStrike Data Connection

Step 2 - Configure CrowdStrike SIEM Integration

Managing Quarantine

All Quarantined Emails (Admin View)

Emails with Modified Attachments

Sending the Unmodified Emails to End Users

Dedicated Quarantine Mailbox / Folder

End-User Daily Quarantine Report (Digest)

Enabling the End-User Quarantine Digest

Emails Included in the Quarantine Digest

Configuring Recipients for the End‐User Quarantine Digest

Restricting End Users from Receiving the Digest

Configuring the Available End User Actions in the Daily Quarantine Digest

Scheduling and Coverage Timeframe for the Quarantine Digest

Allowing End Users to Manually Request a Quarantine Digest on Demand

Configuring a Custom Sender for the Quarantine Digest

Customizing the Text of the Quarantine Digest

Customizing Action Labels

End-User Portal (Avanan Portal)

To enable the Harmony Email Collaboration portal for end users

Accessing the Avanan Portal

Enable or disable an authentication method

Authorizing Login Access for the Organization

Accessing the Avanan Portal from Outlook

Accessing the Avanan Portal from Outlook - End-User Experience

To access the Avanan Portal from Outlook:

Required Permissions for Microsoft/Google Login Authorization

Limiting End User Portal Access to Specific Users

Including Blocklisted Emails in the End User Portal

Read and Unread Status of Emails in the End User Portal

Filtering Emails by their State

Acting on Emails

To manually mark emails as read

Managing Restore Requests

Quarantine Restore Requests

Automatic Handling of Quarantined Restore Requests

Re-evaluated Verdict of Quarantined Restore Requests- Administrator Experience

Requesting a Restore from Quarantine - End-User Experience

To request a restore from quarantine:

Restore Requests for Emails Sent to Groups - End-User Experience

Restoring Emails Without Administrator Approval - End-User Experience

Admin Quarantine Release Process

Cleaned Attachments Restore Requests

Restoring Quarantined Emails - End-User Experience

Who Receives the Emails Restored from Quarantine

Notifying End Users about Rejected Restore Requests

Restore Requests - Notifications and Approvers

Office 365 Email

Authentication for Email Notifications

Adding a Custom Logo

Adding a Branded Header and Footer to Admin Email Notifications

Customizing Time Zone for Email Notifications and Reports

Customizing End User Browser Pages Language

Customizing Retention Period of Emails and Auditing

SmartConfig Recommendations

Incident Response as a Service (IRaaS)

DMARC Management

RUA Mailbox Hosted by Avanan

Discovering Domains from RUA Reports

Virtual RUF Reports

Adding a New Domain

Reviewing the DMARC Status of your Domains

Annotating / Tagging Domains and Sending Sources

Investigating Domains and Sending Sources

Viewing Specific RUA Reports

Improving your Domains' DMARC Enforcement

Monitoring SPF and DMARC Changes

Annotating / Commenting on SPF and DMARC Changes

Manually Adding New Source to SPF Records

Configuring and Defining the SPF Record

Managing Sending Sources

DKIM Management

Activating DKIM Management

Manually Adding New DKIM Selector to your Domain

Managing Selectors

Alerts and Reports

Adding a New Alert

Leaked Credentials

Resetting Passwords for a Compromised User Account

Blocking a Compromised User Account

Security Awareness Training

Creating Security Awareness Training Policy

Customizing Security Awareness Training Policy

Daily Sending Frequency

Customizing the Sender of Security Awareness Training Notifications

Custom Phishing Simulation Templates

Custom Phishing Simulation Templates – Placeholders

Importing Template Email Details from an EML

Assigning Custom Phishing Simulation Templates to Users

Adding a Banner to Phishing Simulation Emails

Authorizing Training Module Access for the Organization

Security Awareness Training Email Headers

Branding the Security Awareness Training Web Page

Security Awareness Training Domains

Monitoring User Interactions with Phishing Simulations

Monitoring User Training Progress

Monitoring Phishing Simulations

Monitoring User Awareness Training Progress

Searching for Security Awareness Training Related Emails in Mail Explorer

Security Awareness Training - End User Experience

Supported Languages for Phishing Simulations and Training Modules

Phishing Simulation Email - End User Experience

Available Training Modules

User Management

Adding a New User

Updating User Information

Deleting a User

Configuration SAML

SAML Configuration for Azure

SAML Configuration for Duo

SAML Configuration for Idaptive

SAML Configuration for JumpCloud

SAML Configuration for Okta

Multi-Factor Authentication using Google Authenticator

Enforcing MFA for the User

Enabling MFA by a User

Logging in via Google Authenticator - End User Experience

Video Tutorials

How to Onboard Office 365 Mail with Avanan

How to Onboard Microsoft Teams with Avanan

How to Onboard Office 365 OneDrive with Avanan

How to Onboard Office 365 SharePoint with Avanan

How to Onboard Gmail with Avanan

How to Onboard Google Drive with Avanan

How to Contact Check Point Support and Incident Response Team from the Avanan Administrator Portal

Phishing Email End-User Experience with Avanan

Password-Protected Attachments End-User Experience with Avanan

Check Point Email Encryption End-User (External Recipient) Experience with Avanan

How to Enable Smart Banners to Emails with Avanan

How to Configure Daily Quarantine Report (Digest) in Avanan and Allow End Users to Generate a Report on Demand

How to Configure Security Awareness Training Policy in Avanan

How to Configure Outlook Add-In with Avanan

User Interaction Administrator Experience with Avanan

How to Request to Restore Quarantined Phishing Emails End User Experience with Avanan

How to Respond to Misdirected Email Warnings in Outlook

How to Report a Phishing Email in Outlook

How to Access the Avanan Portal from Outlook

Smart Banners and Trusted Senders End-User Experience with Avanan

Appendix A: Avanan Manual Integration with Office 365 Mail

Step 1 - Authorize the Manual Integration Application

Step 2 - On-boarding (Monitor only and Detect and Remediate)

Step 3 - Avanan Contact

Step 4 - Journal Rule

Step 5 - Connectors

Step 6 - Connection Filter (All Modes)

Step 7 - Protect (Inline) Protection Mode Policy Configuration on Avanan

Step 8 - Connectors (Protect (Inline) Mode)

Step 9 - Transport Rules (Protect (Inline) Mode)

Avanan - Protect External

Avanan - Protect Internal

Avanan - Protect

Avanan - Allow-List

Avanan - Junk Filter

Avanan - Encryption

Transport Rules

Step 10 - Sending User Reported Phishing Emails to an Internal Mailbox

Reverting Manual Onboarding / Switching to Automatic Onboarding

Unified Quarantine for Manual Mode On boarding with Office 365 Mail

Appendix B: Avanan Manual Integration with Google Gmail

Step 1: Add Groups

Step 2: Adding a Host

Step 3: Updating Inbound Gateway

Step 4: Adding SMTP Relay Host

Step 5: Create a Compliance Rule

IP Addresses Supported by Region for Google Gmail

Appendix C: Manual Steps for Enabling Gmail Prevent (Inline) DLP Policy

Step 1: Adding a Host

Step 2: Updating Inbound Gateway

Step 3: Adding SMTP Relay Host

Step 4: Add Groups

Step 5: Create a Compliance Rule

IP Addresses Supported by Region for Gmail Prevent (Inline) Policy

Appendix E: DLP Built-in Data Types and Categories

Appendix F: Supported Languages for Anti-Phishing

Appendix G: Data Retention Policy

Appendix H: Activating Office 365 Mail in Hybrid Environments

Appendix I: Permitted IP Addresses to access the Avanan Azure Application

Appendix J: Supported File Types for DLP

Appendix K: Troubleshooting

Appendix L: Outlook Add-In

Configuring the Outlook Add-In

Generating the Add-In XML

Deploying the Outlook Add-In through Microsoft 365 Admin Center

Outlook Add-In - Supported Outlook Types and Platform

Automatic Localization of the Outlook Add-In Experience

Appendix M: Configuring Postfix as an Internal SMTP Relay for Non‐TLS Senders to Avanan Cloud SMTP Relay

Postfix Configuration

Restart Postfix to Load the New Configuration

Example Postfix Configuration File

Testing and Debugging Postfix

21 July 2026

© 2024 - 2026 Check Point Software Technologies Ltd.