Sending an email to the wrong person or attaching a sensitive file by mistake can happen in an instant. VIPRE SafeSend Cloud helps eliminate these common but risky errors, by intelligently prompting users to verify external recipients and attachments, adding a simple but powerful layer of security to your email workflow.
This guided setup applies only to SafeSend Cloud. If you are using any version of SafeSend Self-Hosted, please navigate to the SafeSend Self-Hosted guide instead.
Ready to get started? You're in the right place. This guide will lead you through the deployment process from start to finish. If you'd like to learn more about its features first, we invite you to check out our product overview and comparison chart.
Prerequisites
Before you install SafeSend Cloud add-in for Outlook, please verify that you have all of the required prerequisites listed here.
- Verify that your organization meets the System Requirements
- Ensure you have access to your organization's Microsoft tenant with Global Admin or Privileged Role Admin login credentials
Access SafeSend Cloud
SafeSend Cloud is hosted within the VIPRE Symphony portal. If you currently access other VIPRE products via the portal URLs listed below, your account is already configured, and you may skip steps 2 through 4.
- Navigate to the appropriate access URL for your region
- North America: https://security-na.threatsecure.com
- Europe: https://security-eu.threatsecure.com
- Click Forgot password?
- Enter the email address you used to subscribe to SafeSend Cloud and follow the prompts to set your password
- Upon your first login to the VIPRE Symphony portal, you will be prompted to configure Two-Factor Authentication (2FA); you can complete this setup using either SMS or an Authenticator app
Connect your Microsoft Tenant
- When you successfully log in to the SafeSend Cloud web console for the first time, you will see the "Start your account configuration" screen; click the Connect button to begin the integration process
- You will be redirected to the Microsoft "Pick an account" page; select the Global Administrator or Privileged Role Administrator account for the tenant you wish to protect
- Once signed in to your Microsoft tenant, you will see a list of APIs for which SafeSend is requesting permissions; review the requested list and select Accept
SafeSend Cloud requires a mix of Delegated and Application permissions to manage user identity and interact with email metadata for Data Loss Protection (DLP) scanning. You can preview a detailed list of requested permissions below:
API / Permission Name |
Type |
Description |
|---|---|---|
Calendars.ReadWrite.Shared |
Delegated |
Read and write user and shared calendars |
Delegated |
View users' email address |
|
Files.ReadWrite |
Delegated |
Have full access to user files |
Group.Read.All |
Delegated |
Read all groups |
Group.Read.All |
Application |
Read all groups |
Mail.ReadWrite.Shared |
Delegated |
Read and write user and shared mail |
offline_access |
Delegated |
Maintain access to data you have given it access to |
openid |
Delegated |
Sign users in |
profile |
Delegated |
View users' basic profile |
User.Read |
Delegated |
Sign in and read user profile |
User.Read.All |
Application |
Read all users' full profiles |
User.ReadBasic.All |
Delegated |
Read all users' basic profiles |
[BETA] Selecting a SafeSend Cloud Manifest
How your SafeSend Web add-in behaves during a network interruption isn't random. It is dictated by the manifest you choose. SafeSend Cloud provides two pre-configured manifests to control security policies, offline access, and connectivity rules. Understanding the differences is key to ensuring a seamless and secure experience for your users.
SafeSend Cloud Manifest Configuration Options
Choosing the right manifest depends on your organization's security posture, user workflow, and compliance needs.
Warning
Due to Microsoft's email system propagation processes, any changes to your manifest deployment option can take up to 72 hours.
Enforced Protection Mode
Choose this if your organization is seeking a balance between robust security and practical usability.
This manifest is the best-of-both-worlds solution. It enforces your security policies to prevent accidental data loss but is designed to handle common issues like network interruptions gracefully, ensuring users remain productive. It provides real security without the heavy-handed restrictions of the strictest mode.
- Ideal for: A general deployment across most of your users
- User Experience: Secure and reliable, with built-in safeguards
- Core Benefit: Enforces security rules while maintaining a smooth workflow
User Experience
Emails are checked as you're composing. If a review is needed, tips are provided at the top of the email and within the task pane asking you to Review. (Clicking Dismiss only dismisses the tip, not the need to review.)
- In the event of a loss of connectivity to SafeSend, end users will still be able to click Send Anyway and bypass SafeSend
- End user is unable to use Outlook Offline Mode
User Prompt Mode
Choose this if your primary goal is to educate users and foster security awareness with minimal disruption.
This manifest acts as a helpful "guardrail" rather than a locked gate. It alerts users to potential issues with their email but ultimately trusts them to make the final decision. It's the best choice for organizations that prioritize workflow speed and user autonomy while still encouraging secure practices. When using in Outlook Offline Mode,
- Ideal for: Organizations with a strong culture of trust
- User Experience: Lowest friction; policies are advisory
- Core Benefit: Promotes awareness without blocking productivity
User Experience
Emails are checked as you're composing. Tips are provided in the task pane asking you to Review or Send. When the end user clicks Send without reviewing, these three choices come up every time: Send Anyway, Review, or Don't send.
- In the event of a loss of connectivity to SafeSend, end users will still be able to click Send Anyway and bypass SafeSend
- In Outlook Offline Mode, end users can hit Send and the email will wait in the Outbox and send automatically upon reconnection to the internet, bypassing SafeSend (acting as if there is no add-in)
Manifest Configuration Comparison
| Manifest Config Mode | Online Behavior | Behavior in Outlook Offline Mode | Behavior if SafeSend server is unreachable |
|---|---|---|---|
| Enforced Protection Mode | Emails are checked as you're composing. If a review is needed, tips are provided at the top of the email asking you to Review. |
Email Blocked
|
Bypasses SafeSend
|
| User Prompt Mode | Emails are checked as you're composing. Tips are provided in the task pane asking you to Review or Send. When the end user clicks Send without reviewing, these three choices come up every time: Send Anyway, Review, or Don't send. |
Bypasses SafeSend
|
Bypasses SafeSend
 |
Still unsure? Click Get Help within the SafeSend Cloud admin console to request additional assistance.
SafeSend Cloud: Policies
In the SafeSend Cloud admin console, you gain centralized control over your entire organization's email security. This is where you configure your desired policies, rules, and user assignments. Each SafeSend policy provides comprehensive, per-policy control over critical settings, such as Global and Advanced settings, Data Loss Prevention (DLP), Encryption, and Override Text Strings.
Create a Policy
Before you create any custom policies, there is a Default Policy that you can use as-is, or as a starting point to customizing your own policy, by clicking Clone. You might want to do this if you need a functional template quickly. Cloning saves you from manual data entry by pre-populating the standard rules, so you only have to focus on the unique changes your team requires.
If you prefer to configure your policy options from scratch, the following instructions will walk you through the process step-by-step. These steps assume you are already logged in to the SafeSend Cloud web console.
To create a new policy:
- Navigate to Manage > Policies > + Add Policy
- Name your policy in a way that appropriately describes it and click Save
- Once your policy is created, find it in the list and click the name of the newly created policy to open and configure it
- Review the table below to learn about policy options
| Policy Option | Description |
|---|---|
| Global |
Under Global, you'll see where you can edit the policy name and optional description.
Other options include:
|
| Advanced |
Under Advanced, you'll find the following options:
 |
| DLP |
DLP (Data Loss Prevention) scans emails and attachments for specific client keywords or regular expressions, then requires user confirmation before the email is sent.
Policy-based DLP settings include:
 To read more about Data Loss Prevention, including the complete process to configure and manage DLP rulesets, visit SafeSend Cloud: Data Loss Prevention (Rulesets).
|
| Encryption |
SafeSend provides the trigger mechanism to initiate encryption based on your business rules. Your organization must still provide and maintain its own encryption service to secure the actual message. Encryption options include:
 |
| Strings |
Under Strings, you can override any text string that applies specifically to the assigned users in your policy.
|
- When you are done configuring your policy, click Save at the top
SafeSend Cloud: Data Loss Prevention (Rulesets)
Using rulesets, VIPRE SafeSend Cloud can prevent sensitive information from being sent out to the wrong client. DLP (Data Loss Prevention) scans emails and attachments for specific client keywords or regular expressions, then requires user confirmation before the email is sent.
There are three important features associated with DLP:
- Client Keyword/Domain Scanning allows you to identify a set of client keywords or regular expressions and associate those with a set of client domains or individual email addresses
- DLP Content Scanning presents sensitive content to the user, allowing the user to determine if the email should be blocked or sent with additional confirmation
- DLP Scan Password-Protected Attachments allows SafeSend to detect password-protected .zip files and prompt the user to add the password and decrypt the file so it can scan the attachment
Create a DLP Ruleset
- Navigate to MANAGE > Rulesets
- Click +Add Ruleset in the top right corner
- Name your ruleset and click Save
- Find your newly created ruleset in the list then click the name to open it
Content Scanning Rules
- To add a content scanning rule, click +Add Rule under Content Scanning Rules
- Name your content scanning rule
- Select from the following actions in the dropdown box: Inform, Confirm, ConfirmText, Deny
- Confirm is the default selected action
- Choose the content type: All Support Files, All Except PDF, or Specific File Types
- If selecting Specific File Types, a box will appear allowing you to select all desired file types you want DLP to scan
- Write a regular expression (also known as regex)
- If you need assistance, you can do an Internet search for a regex generator or use an AI model to help create a regex
- For the purposes of this example, in the screenshot below, we used AI to generate a regex to look for social security numbers, but you can also use it to look for things like credit card numbers, national insurance number, and other sensitive data types
- Test your regex by adding test strings to match and test strings to NOT match
- Green indicates the test passed; Red indicates the test failed
- When done, click OK at the bottom
Pro Tip: Using Test Strings for DLP Rule Management
The Test Strings feature is an essential, built-in Regex tester that saves your input for future rule modifications. Using it can drastically improve your workflow:
Scenario 1: Immediate Validation
- When creating a new DLP rule, use the Match and Not Match sections to immediately test your regular expression (regex) right inside the editor; this ensures your rule is accurate before deployment
Scenario 2: Future Proofing Modifications
- If a rule needs to be updated (e.g., due to false positives from product numbers being flagged as PII) months after deployment, you can easily use the saved test strings to quickly test your regex modifications and confirm the change fixes the issue without breaking the rule's original intent; this avoids the need to find an external online tester and rebuild test data from scratch
Client/Keyword Domain Rules
- To add a client/keyword domain rule, click +Add Rule under Client/Keyword Domain Rules
- Add any keywords you want SafeSend to look for
- Add any domains or email addresses you want to associate with the above keywords
- Alternate Text Domain replaces the visual representation of specific domains with your preferred display text
- Click OK
Link Policies
- To link a policy to your DLP ruleset, locate the desired policy in the Not Linked column and drag it over to the Linked policy
- Click Save at the top
To manage an existing DLP ruleset
- From within the SafeSend Cloud console, click on Manage > Rulesets
- Select the desired existing ruleset from the list by clicking on the name
- On the left side of your screen, you can edit existing content scanning rules or client/keyword domain rules by clicking on the pencil icon in the same line as your rule
- On the right side of your screen, you can change the policy associated with your ruleset by dragging the policy between Linked and Not Linked; you can also link rulesets to a policy within the DLP setting under Policies
For complete details on SafeSend Cloud policies, including additional policy-based DLP settings, navigate to: SafeSend Cloud Policies.
These users and groups will be auto-populated from Microsoft Entra ID. Any groups you want to create specifically for SafeSend should be created in Entra ID first.
- Navigate to MANAGE > Assignments, then the +Add Assignment button
- Name your assignment, then choose a policy from the dropdown menu
- To assign specific users or groups to the chosen policy, click Add Users and/or Add Groups
- Click Save
Deploying SafeSend Cloud
With VIPRE SafeSend Cloud, you can deploy to your whole organization or individual users.
Please note that these instructions assume you have already selected and downloaded your manifest file. If you have not yet done this, please refer to Selecting a SafeSend Cloud Manifest.
The following steps involve navigating third-party interfaces. While these instructions are accurate at the time of publication, vendors frequently update their user interface (UI) and menu layouts. Please use this guide as a reference for the specific VIPRE data and configurations required; the exact navigation paths within the third-party application may vary slightly.
From within the Microsoft 365 Admin Center, upload your manifest file by navigating to Settings > Integrated Apps > Upload Custom App > Office Add-in.
Do you want to deploy SafeSend to your entire organization or only to specific users/groups?
Specific Users/Groups
Instead of a global rollout, you can target specific individuals or groups for testing or phased deployment.
- In the Add users section, select Specific users/groups
- Use the search field to find the users or security groups you wish to include
- Confirm the users appear in the "To be added" list
- Click Next
- On the Accept permissions requests screen, click Accept permissions
- A Microsoft login window will appear; sign in with your administrator credentials and click Accept to grant SafeSend the necessary access to mail and profile data
- Once the status shows Permissions accepted, click Next
- Review your deployment settings and click Finish deployment
The system will display "Deployment in progress." Once finished, you will see a Deployment completed message. Click Done to return to the Integrated Apps list, where VIPRE SafeSend should now be listed as “Enabled.”
Deployment can take up to 72 hours to fully propagate across the Microsoft 365 environment. Users may need to restart Outlook.
Entire Organization
- Select the Entire organization radio button to ensure all users receive the add-in automatically
- On the Accept permissions requests screen, click Accept permissions
- A Microsoft login window will appear; sign in with your administrator credentials and click Accept to grant SafeSend the necessary access to mail and profile data
- Once the status shows Permissions accepted, click Next
- Review your deployment settings and click Finish deployment
The system will display "Deployment in progress." Once finished, you will see a Deployment completed message. Click Done to return to the Integrated Apps list, where VIPRE SafeSend should now be listed as “Enabled.”
Deployment can take up to 72 hours to fully propagate across the Microsoft 365 environment. Users may need to restart Outlook.
Next Steps
Congratulations! SafeSend Cloud has now been deployed and is ready for use. To further customize your environment or begin monitoring activity, explore the following resources:
- Release Notes - Stay informed on the latest features and updates added to the platform
- SafeSend Cloud: Settings - Add your organization's logo, verify your Microsoft Entra connection, or review other manifest options
- SafeSend Cloud: Dashboard - Gain a high-level overview of your organization's email security trends
- SafeSend Cloud: Reports - Monitor your organization's email security trends and review log of every processed message
- SafeSend Cloud: Strings - Review how to further customize the text and language used in user prompts