> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/human-security/phishing/setup.md).
# Setup
Sync your employees, then let Stoïk Protect send the simulation emails through your email provider.
## Prerequisites
* A **Global Administrator** account (Microsoft 365) or a **Google Workspace administrator** account.
* For Google Workspace or Microsoft 365 only. For another email solution, see [Manual employee import](/human-security/phishing/manual-import.md).
## Set up the simulation
{% stepper %}
{% step %}
### Sync your employees
1. Go to `Simulations` in Stoïk Protect.
2. Click `Activate phishing simulation`.
3. Choose **Google Workspace** or **Microsoft 365**.
4. Sign in with an account that has **mailbox administrator** rights.
{% endstep %}
{% step %}
### Enable email sending via API
Phishing simulations mimic real attacks, so spam filters may block them. Stoïk Protect sends them through your provider's API (Gmail API or Microsoft API) so they reach the inbox.
{% tabs %}
{% tab title="Microsoft 365" %}
1. When prompted in Stoïk Protect, sign in with a Microsoft 365 Global Administrator account.
2. Review the requested permissions.
3. Click `Accept`.
Microsoft 365 permissions
You are redirected to a Microsoft page requesting read and write access to your employees' Outlook mailboxes. These permissions will allow to configure phishing campaign with templates that are actually relevant down the line. Here are the details of the requested permissions:
| **Read all audit log data** | Enables you to read all of the organisation's audit logs for investigation and monitoring purposes. |
| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Read audit logs data from all services** | Allows the application to read audit logs from all Microsoft 365 services for threat detection and compliance. |
| **Read and write mail in all mailboxes** | Provides full read/write access to all messages in mailboxes (used for analysis, remediation, or actions on malicious emails). |
| **Read and write all user mailbox settings** | Allows you to modify mailbox settings (rules, signatures, forwarding, etc.) for all users. |
| **Read your organization's conditional access policies** | Allows the application to read the conditional access policy configuration for auditing or security posture analysis. |
| **Read all usage reports** | Provides access to usage and activity reports across the organisation (Microsoft 365 analytics). |
| **Read metadata and detection details for all emails in your organization** | Allows access to email metadata (headers, detections, threat indicators) without accessing the content of the messages. |
| **Read all users' full profiles** | Provides full read access to user profiles (name, position, attributes, etc.). |
| **Read and write all users' authentication methods** | Allows you to modify user authentication methods (MFA, telephone, email, etc.). |
| **Sign in and read user profiles** | Allows the application to log in as a user and access basic profile data. |
| **Read and write all password profiles and reset user passwords** | Allows you to reset or update passwords for all users, necessary for incident remediation. |
| **Revoke all sign in sessions for a user** | Allows you to immediately revoke all active sessions for a user, used for immediate containment. |
| **Read activity data for your organization** | Enables Stoïk to read events from the Microsoft 365 activity feed to detect suspicious actions or anomalies related to user activity. |
| **Read all applications** | Allows the application to read all applications and core service objects in the tenant, used to analyse the configuration and identify anomalies. |
{% endtab %}
{% tab title="Google Workspace" %}
1. Sign in to the Google Admin Console
2. Go to [Domain-wide Delegation](https://admin.google.com/ac/owl/domainwidedelegation) (`Security` > `Access and data control` > `API controls` > `Domain-wide delegation`)
3. Click `Add new`
4. In the `Add a new client ID` window, enter the following:
**Client ID**
```
115890102773233849646
```
**OAuth scopes**
```
https://www.googleapis.com/auth/gmail.insert, https://www.googleapis.com/auth/gmail.metadata
```
5. Click `Authorize`
6. Return to Stoïk Protect and click `Confirm`
{% endtab %}
{% endtabs %}
If an error appears, see [Common setup errors](/human-security/phishing/setup-errors.md).
{% endstep %}
{% endstepper %}
Your phishing simulation is ready. Check that your tenant shows the `Active` [status](/human-security/phishing/tenant-statuses.md).
## Automatic campaign
Once the setup is complete, Stoïk Protect creates a campaign named "Continuous campaign" so your employees are trained from day one:
* Start date: tomorrow
* Email distribution: spread over 14 days
* Recurrence: continuous (the campaign repeats automatically)
* Audience: all active employees
* Content: all available templates and scenarios
It shows a specific icon with the tooltip `Automatic campaign`. Some of its settings are fixed:
* It cannot be deleted, only paused.
* Its recurrence is locked to continuous.
* It must always include at least one employee and one phishing scenario.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.stoik.io/human-security/phishing/setup.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
