Scope & packages
Packages for the architecture integration. You receive a binding fixed-price quote for your scope. KnowBe4 licenses are billed separately per user.
- Basic configuration of the KnowBe4 tenant
- Exchange Online allowlisting (mail flow)
- One-time Entra ID user sync
- Setup of an automated baseline campaign
- Everything in Essentials
- Entra ID SCIM provisioning (zero-touch)
- Advanced delivery policies (Defender for Office 365)
- Smart Groups & automated assignment
- Everything in Corporate
- SSO integration via an Entra ID enterprise app
- Multi-domain & multi-tenant routing
- Custom reporting & Phish Alert Button deployment (Intune)
Technical details
Details for technical validation.
Identity Integration (SCIM & SSO)
Building the identity bridge between Microsoft Entra ID and KnowBe4. I configure the enterprise application, set up single sign-on (SAML/OIDC) and enable SCIM provisioning for fully automated lifecycle management.
- Entra ID Enterprise App Deployment
- SSO Configuration & Certificate Management
- SCIM Provisioning & Attribute Mapping
Exchange Online & Defender Hardening
Ensuring deliverability. I configure Exchange mail flow rules, connectors and advanced delivery policies in Microsoft Defender for Office 365. This prevents Microsoft's filtering (Safe Links / Safe Attachments) from altering simulated phishing emails or moving them to quarantine.
- Defender Advanced Delivery Configuration
- Exchange Online Mail Flow Rules (Bypass Spam Filtering)
- Phish Alert Button (PAB) Deployment via Intune
Campaign Engineering & Smart Groups
Designing the automation logic. I build “Smart Groups” that dynamically route users into specific training and phishing campaigns based on Entra ID attributes (department, risk score, start date).
- Baseline Phishing Campaign Setup
- Dynamic Smart Group Architecture
- Automated Remediation Training Routing
Reporting & Compliance
Establishing the metrics. I set up automated management reports that measure the organization's “Phish-prone Percentage” (susceptibility rate) and provide direct evidence for ISO 27001 audits or cyber insurance.
- Executive Management Dashboard Setup
- Automated Compliance Reporting
- Risk Score Definition & Tracking
What this sprint does not include:
- Custom content creation: I use KnowBe4's preconfigured templates. Writing fully custom, company-specific phishing emails (e.g., a replica of your exact intranet) is not included.
- 1st-level support: When employees forget their password, have questions about a training module or report a real phishing email, your internal IT help desk handles it.
Benefits for your business
The ROI for management.
Frequently asked questions
Why KnowBe4 and not another security awareness platform?
KnowBe4 is one of the established security awareness platforms and offers a very extensive library of training content and phishing templates. Its deep Microsoft 365 integration through SCIM and its AI-assisted content creation make it an obvious choice for organizations that want to make full use of their Microsoft infrastructure.
What happens if someone clicks a simulated phishing link?
That is exactly the learning moment. The person is automatically redirected to a “Teachable Moment” page and immediately receives a short training module. In the Corporate and Enterprise tiers, these people are automatically moved to a “High-Risk” group and receive more intensive training.
Doesn't Microsoft Defender block phishing emails anyway?
Yes, and that is the problem for simulation platforms. Without the correct configuration of advanced delivery policies in Defender for Office 365, simulated phishing emails would be moved to quarantine or altered by Safe Links. I configure these exceptions specifically for KnowBe4 so that the simulations reliably reach your employees.
How are new employees automatically added to the training?
Through SCIM provisioning. When a new account is created in Entra ID, it is automatically provisioned in KnowBe4 and, based on its attributes (department, location), added to the matching Smart Groups and training campaigns. No manual intervention needed.
Are the KnowBe4 licenses included in the sprint?
No. The sprint covers the technical tenant setup and the integration. KnowBe4 licenses are billed separately per user per year. I help you choose the right license model (Silver, Gold, Platinum or Diamond) based on your requirements.