The Smart Banners Setup Checklist is a step-by-step guide for deploying Smart Banners within a company.

Checklist consists in 7 steps:

• Company Setup
• API Access Setup
• Test Deployment
• (Optional) Run historical analysis
• (Optional) Define your safe lists
• (Optional) Send sample emails
• Engage Company

Pre-requisites

Complete dedicated "GENERAL SETTINGS" prerequisites (see dedicated article)

1. Company Setup

The first step of setup checklist shows the defined mail provider (Gmail or Office) and confirmation that company setup is complete.

If a warning is displayed, it means Banners setup was not completed by internal support team

2.API Access setup

Office tenants

This step will always appear as complete for admins from Office tenants, because API permissions have to be granted prior to accessing the setup checklist (in General Settings)

Google tenants

Button "How to grant Consent" (banners) is displayed to companies with Gmail configured as their mail server .

• Login to your Google Workspace Admin console: https://admin.google.com

• Search for "API controls" and select "API controls".

• Select Manage Domain Wide Delegation

• Click on Add new

Paste the Client ID (check in the console)

• Add the Following scope to "0Auth scopes" :

  • https://www.googleapis.com/auth/gmail.settings.basic, https://www.googleapis.com/auth/gmail.labels,
  • https://www.googleapis.com/auth/gmail.metadata, https://www.googleapis.com/auth/gmail.modify,
  • https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.insert,
  • https://mail.google.com/

• Click on Authorize , and go to: https://app.mantra.ms/banners/setup

• Click "I confirm I have given access to the service account." Completion of the step is declarative

3.Test deployment

This section aims at testing that workflow is functional. Admin who clicks on Test deployment button should receive a test email with a banner.

Pre requisite:

• Admin should be engaged - Engage one User button will redirect user to Smart Banners > Users (Engage) where he can engage himself.
• Admin should have granted permissions to send email: General Settings - Google|Office users provisioning → Grant Direct Message Injection to Mantra

The following Test email is triggered from Smart Banners Setup Checklist - Test deployment

BEST PRACTICE: Wait 30 seconds before opening the email

Confirm you have receveid the email with the banner.

4. Historical analysis

Historical analysis is there to help admins identify the most obvious false positives prior to launching banners on their entire company, so they can add them to their safe list.

The analysis does not add actual banners on emails, and users do not need to be engaged for analysis to be performed.

The operation is not clearly perceptible to users and can be repeated several times.

Steps:

• Admin can select up to 100 users and hit analyze.
• Analysis will process the last 3 months of email history of the selected users.
• Analysis will take a few minutes, based on the number of emails to process (ex. 100 users x 3 months x 20 emails/day ≈ 180k emails).
• Once completed, analysis will be available as a CSV file.
  • Admins can now review the senders (emails) or domains that virtually triggered the most banners and add them to their safelist.

• CSV content and fields

  CSV contains the list of all senders emails which triggered at least 1 banner. The majority of senders do not trigger banners and won't appear in the file. The detail of signals that were triggered is not available.

  field name	description
  sender_address	email address of the sender who triggered banners
  info	number of emails from sender that triggered a gray banner
  suspicious	number of emails from sender that triggered a yellow banner
  very_suspicious	number of emails from sender that triggered a red banner
  processed	number of emails from sender that have been analyzed

• CSV file - output example

  The senders listed in this historical analysis have triggered banners on 100% of the mails they sent. Admin knowing they are reliable can add emails or entire domain to safelist.

  sender_address	info	processed	suspicious	very_suspicious
  alertes-mane@kbcrawl.net	0	10221	10211	10
  eventing@vantagepoint.com	0	3477	3477	0
  culturesurvey@horizons.confirmit.eu	0	3113	3113	0
  support@datahubtechnologies.com	0	2544	2544	0

5. Define your safe lists

This section redirects admin to Smart Banners Setup - Preference (Safelist)

Preference (Safelist)

Safelist enable admins to deactivate banners on specified senders or domains.

Emails from safe senders/domains will never trigger banners ( --> Add safe domains/ Add safe senders)

6. Send sample emails

This section enables admin to send sample emails to targeted users to ensure that banners are correctly triggered.

This feature allows you to send sample phishing emails to multiple admins simultaneously, selecting the specific phishing scenario you want to simulate. This provides an accurate preview of what recipients will experience when they encounter a suspicious email in a real campaign.

It is recommended to run a two-week pilot with smart banners enabled for a subset of users, then collect feedback before deciding how and when to roll out the feature to the broader audience.

Each sample email is available in french and english and should trigger specific signals on top of First Time Sender (FTS).

Troubleshooting

The step returns an error when CEO information is missing from General Settings - Company Scan.

7. Engage company

Section "Smart Banners> Setup Checklist - Engage company" shows admins the percentage of users with banners activated.

When Auto Engage is enabled, every day ~11 AM (10 UTC / 12 CET), all newly provisioned users are engaged automatically.

• The process uses cloud tasks with a rate limit, so activations happen gradually rather than all at once.
• Users get engaged progressively as the queue processes.

This ensures everyone is onboarded smoothly without overloading the system.

note: manually disengaged users are ignored from auto-engage.

Banner rate

A good value for us is between 0.5% and 5% (depending on the asset). This indicates that banners are not being activated too frequently, which is a sign of proper whitelisting activity.