Product setup guides, allowlisting references, campaign basics, and reporting help. Tenant admins can find environment-specific domains and IPs inside the in-app Help Center.
The tenant console is organized around the daily workflow of a security administrator: check the dashboard, verify domains, add employees, create campaigns, and then review reports. Use the sidebar as the main route map.
Start here after login. The dashboard gives tenant admins a quick view of campaign activity, employee posture, and program health.
This is where tenant admins verify employee domains and review security controls before adding users or launching campaigns.
Use this area to add employees, import CSV files, and organize people into groups for cleaner campaign targeting.
Campaigns are where tenant admins select templates, choose audiences, configure scheduling, and watch send progress.
Reports are simplified into one executive view for leadership, while campaign-specific exports remain inside each campaign.
Understand tenant setup, domain verification, employee import, and first campaign launch.
Use the setup wizard to confirm account details, branding, domain verification, employees, and your first campaign.
The setup wizard should behave like a guided checklist. If a tenant already verified a domain or added employees elsewhere, the wizard should show that progress instead of forcing duplicate work.
Verify the company email domain before adding employees. This prevents unauthorized targeting outside your organization.
Domain verification is the gate before adding employees. The verified domain list is what employee onboarding and campaign validation should check against.
Import employees after domain verification, then organize them into groups for cleaner campaign targeting.
The employee flow should end with a review screen. Admins should confirm the user details, group, and domain status before the employee is onboarded.
Prepare Microsoft 365, Google Workspace, secure email gateways, and proxy tools.
Allowlist sending domains, landing/tracking domains, simulation headers, and static IPs where available. Always test with a pilot group before broad rollout.
Allowlisting is not one setting. It may involve the mail platform, secure email gateway, URL protection, image proxying, and endpoint/browser security controls.
Use Microsoft Defender Advanced Delivery for phishing simulations where available. Add PhishEon sender domains and simulation URLs, then test with a pilot mailbox.
Microsoft 365 customers should start with Advanced Delivery for phishing simulations, then validate whether Safe Links, Safe Attachments, or third-party gateways still modify the message.
Use Google Admin Gmail allowlist/compliance rules for approved simulation senders. Scope bypasses to PhishEon sender domains, IPs, or headers.
Google Workspace rules should remain narrow. The goal is to allow PhishEon simulation traffic without weakening protection for ordinary emails.
Permit simulation sender domains, configured IPs, and landing/tracking hostnames. Avoid broad bypasses; scope rules to approved simulation indicators.
Secure email gateways commonly sit before Microsoft 365 or Google Workspace, so they can block or rewrite training emails even after mailbox rules are configured.
Use templates, campaign presets, scheduling, throttling, and campaign-level reports.
Choose employee groups, select a ready template, set launch timing and send rate, then confirm the campaign.
Campaign creation should move through clear tabs and finish with confirmation. The admin should know the audience, template, schedule, send rate, and deadline before launch.
Open a campaign detail page to review delivered, opened, clicked, submitted, reported, and replied activity. Export PDF or CSV for campaign-specific evidence.
Campaign reports explain what happened in one simulation. They are best for evidence, target status checks, and operational troubleshooting.
Read executive summaries, campaign results, and human-risk indicators.
Use the Reports page for a single management-ready summary. Use campaign exports when you need recipient-level details.
The executive report should be polished and management-ready. Keep detailed recipient-level evidence inside campaign exports.
Check scheduler status, platform SMTP readiness, domain verification, allowlisting rules, and campaign target statuses.
Troubleshooting should start with the campaign target status. From there, check scheduler timing, SMTP/template binding, verified domains, and mail gateway logs.
Use these values as a starting point. Tenant-specific static IPs and configured sender domains are shown inside the in-app Help Center.
phisheon.io notify.eoncyber.in
phisheon.io Your configured PhishEon tracking or landing host
X-PhishEon-Simulation X-PhishEon-Tenant
Use the IP list shown inside your tenant Help Center after your platform SMTP is configured.
Tenant admins can see configured platform sending domains, landing domains, headers, and any static IPs inside the PhishEon console.