OutThink can deliver both training and phishing simulation emails to your employees efficiently and reliably via our scalable email infrastructure. This however typically requires a series of whitelisting steps to ensure that emails are not rejected as phishing or spam, not clicked by email filters, and correctly land in your user's inboxes.

By using the OutThink Direct Mail Injection (DMI) app instead, emails will be created and directly injected into your employees’ inbox using Microsoft Graph API, without using any Email Infrastructure.

The benefits of this approach are as follows:

• There is no need to whitelist incoming email through your mail server, or gateway, saving you time and increasing the reliability of delivery.
• The OutThink SaaS Platform has no direct connection with the your environment. The Direct Mail Injection (DMI) App makes simple and secure outbound HTTPS requests to OutThink’s API to detect emails to deliver. This means no inbound connections are required to your environment.
• The data which is transferred between the OutThink API and your Azure environment is constrained to just the content of the email to be sent, and a list of your user’s EntraID Object Identifiers to determine who to send to.
• The Graph API permission Mail.ReadWrite is required to inject email into employee’s inboxes. However, the Direct Mail Injection (DMI) App running in your Azure environment does not have direct access to this permission at all.
  All requests are proxied, which is protected by a Client Id and Client Secret (stored in Key Vault).