This article helps you add the Expel Phishing Button for Google Workspace.

Prerequisites

This process must be completed by one of the organization’s Google Workspace administrators with the proper permissions.

Quick Links

Install the Extension
Configure the Extension for All Users
Allowlist the Extension
Enable Domain-Wide Delegation

Step 1: Install the Extension

Have a Google Workspace administrator log in to https://admin.google.com/.
From the Admin Console, select Devices.
In the navigation pane of the Devices page, select Chrome > Apps & extensions > Users & browsers.
In the lower right corner of the page, select the yellow + button and then select Add Chrome app or extension by ID.
In the box that appears, enter the extension ID gpkcimdiphdhnenbncknfiakplflhmnc and select Save.
Select the arrow next to the extension and choose Force install.

Step 2: Configure the Extension for All Users

With the Expel Phishing extension selected, an option panel appears on the right. In that option panel, locate the Policy for extensions field.

The Policy for extensions field expects a JSON block. Our custom JSON configuration accepts three parameters:

destinations_forward_attachment REQUIRED (array of strings)
- Where the submitted phishing emails will be forwarded to as an attachment. 

 This is where the Expel Phishing alias provided by the EM should be entered.

destinations_forward_inline (array of strings)
- Where submitted phishing emails will be forwarded to inline.

valid_domains REQUIRED (array of strings)
- List of domains for which the button appears

(for example, if gmail.com is included, users logging into 
personal Gmail accounts see the button).

custom_success_message (string)
- Customized success message to show on submission of email to Expel Phishing.

move_to_trash (boolean) DEFAULT is true - Set to false and the button leaves the original 

message in the user’s inbox. If set to true, the button moves the original message to the trash folder upon submission.

Below are some example configurations and we're happy to help build this with you if that's preferred. After you decide on the configuration, paste the JSON block into the Policy for extension area.

Forward to Expel only

{
"customConfig":{
“Value”:{
“destinations_forward_attachment”: [“alias@expel-phishing.io”],
“valid_domains”: [“company.com”],
“custom_success_message”: “Thank you for being vigilant! The security team is looking into this and will update you shortly.”
}
}
}

Forward to both an internal distribution list and Expel

{
"customConfig":{
“Value”:{
“destinations_forward_attachment”: [
“phishingreport@company.com”,
“alias@expel-phishing.io”
],
“valid_domains”: [“company.com”]
}
}
}

Forward to both Expel as an attachment and an internal security team as inline

{
"customConfig":{
“Value”:{
“destinations_forward_attachment”: [“alias@expel-phishing.io”],
“destinations_forward_inline”: [“security@company.com”],
“valid_domains”: [“company.com”]
}
}
}

Forward to both Expel and an internal security team and also show the button for users logging into personal Gmail accounts

{
"customConfig":{
“Value”:{
“destinations_forward_attachment”:
[“alias@expel-phishing.io”, “security@company.com”],
“valid_domains”: [“company.com”, “gmail.com”]
}
}
}

5. Select SAVE to complete the configuration.

Step 3: Allowlist the Extension

Navigate back to the Google Workspace admin console at https://admin.google.com/.
Scroll down and open App access control.
Select MANAGE THIRD-PARTY APP ACCESS.
In the Connected apps section, hover over Expel Phishing and select Change access.
Choose Trusted: Can access all Google services and then select SAVE.

The Expel Phishing app is now listed as Trusted in the Connected apps view.

Step 4: Enable Domain-wide Delegation

Go back to the Admin console and select Security.
Scroll down and open App access control.
Select MANAGE DOMAIN WIDE DELEGATION.
Select Add new.
Enter the following for the Client ID and the OAuth Scopes:

Client ID: 528472867238-v8803num13j6691ue52qqm6tuoqpu9ns.apps.googleusercontent.com

OAuth scopes: https://www.googleapis.com/auth/gmail.modify