Sending the links: your Microsoft 365 mailbox, Gmail, Outlook, Teams, Slack or one by one

When a campaign goes live you get one personal link per person. Each link works once and carries its own set of questions, so it has to reach one person and nobody else. SafeToOpen never emails your people on purpose: an unexpected message from a security vendor asking someone to click a link is the very thing the check is about. The invitation comes from you. This guide makes that quick.

1. Before you send: pair the links with people#

Open the campaign in the console (https://plus.safetoopen.com/scam-check → the campaign → results) and find the Send the links card. It appears the moment the campaign is live, and again on the results page.

1. Step 1 of the card: paste your people, one per line. Any of these shapes work: Jane Smith <[email protected]>, Jane Smith, [email protected], or just [email protected]. Copying two columns from a spreadsheet pastes as “name, email” and works too.
2. Click Assign links to these people (named campaign) or Pair these people with links (anonymous campaign). Each person now has their own link.
3. Step 2: read the email text and change anything you like. Keep {FirstName} and {Link} where they are; the sending tool fills them in for each person. {Company}, {Minutes} and {Expires} are already filled in.
4. Step 3: pick the tab for the tool you use and follow the steps in it, which are the same as in the sections below.
5. Step 4, once the emails are out: click Mark all as sent, so the results page dates the send and, in a named campaign, shows who has not opened their link.

The mail-merge file is a small spreadsheet with four columns: Email, Name, FirstName, Link. Every method below starts from it.

2. Fastest: connect your Microsoft 365 mailbox#

If your organisation uses Microsoft 365, you do not need a merge at all. Connect your mailbox once and SafeToOpen sends one email per person from your own address, through your own tenant, with a copy in your Sent Items. Replies come to you. Reminders go out the same way, on a schedule you set. The connection is send-only, for your mailbox only, and you can remove it at any time.

1. Open the My Microsoft 365 mailbox tab and click Connect my Microsoft 365 mailbox. Microsoft asks you to sign in and to allow SafeToOpen to “send mail as you”. Accept. You come straight back to the campaign.
2. Step 1 now offers Pick people from Microsoft 365: search or filter by department, tick the people (or Select all shown), Add to the list. Their full names and addresses come from your directory, so the greeting is right and nothing is typed. Shared and role mailboxes (no-reply, support, contact, meeting rooms, anything with no first and last name or no licence) are hidden; tick Show shared and role mailboxes if you need one. You can still paste addresses as well.
3. Read the email in Step 2 and change anything you like.
4. Click Send me a test. An email arrives in your own inbox with a preview link, so you can see exactly what people will receive. Change the text in Step 2 if you want, and test again.
5. Click Send N invitations now. On a named campaign the first 25 go immediately and the rest follow at 25 a minute on their own; you can close the page. On an anonymous campaign the emails go in small batches while the page is open, because SafeToOpen holds no addresses; keep the tab open until the counter reaches the end.
6. Named campaigns: under Reminders, tick Send reminders, keep or adjust the days (3 days for people who have not opened, 6 days for people who opened but did not finish, at most 2 per person) and click Save. Reminders stop when someone finishes or their link expires, and nobody gets more than one every three days. You can also send a reminder immediately with the button below the schedule.

Google Workspace mailboxes will follow once Google has verified the sending scope. Until then Gmail users use the mail merge in section 3 or the one-by-one method in section 6.

3. Gmail (Google Workspace)#

Gmail has a built-in mail merge: one email per row of a spreadsheet, each with its own link. It needs a Google Workspace account on Business Standard or higher, or Workspace Individual. A personal @gmail.com account does not have it; use section 6 instead.

1. In the Send the links card, Gmail tab, click Download mail-merge file. Then click Copy subject.
2. Open Google Sheets → Blank spreadsheet → File → Import → Upload → choose the downloaded file → Import data. You now have the four columns.
3. Open Gmail → Compose. On the To line, click the people icon at the right end (“Use mail merge”) so it is switched on, then click Add from a spreadsheet and choose the sheet you just made. Gmail finds the Email column by itself.
4. Paste the subject. Back in the console click Copy email text (with @Link) and paste it into the body. It already contains @FirstName and @Link; Gmail shows them as blue merge tags.
5. If a tag shows as plain black text instead, delete it and type @ in the body: a list of the sheet’s columns appears; pick FirstName or Link.
6. Click Continue, then Send all. Gmail sends one separate email per row. Open your Sent folder and check one: it should show a real link.

4. Outlook (Word mail merge)#

Word’s mail merge hands one email per row to Outlook. It works with the classic Outlook desktop app on Windows, and with Word for Mac when Outlook for Mac is the default mail app. It does not work with the “new Outlook” on Windows or with Outlook on the web; if that is what you use, switch the New Outlook toggle off for the send, or use section 6. If your organisation is on Microsoft 365, section 2 is simpler than any of this.

1. In the Send the links card, Outlook tab, click Download mail-merge file and note where it was saved. Do not open it in Excel first: Word reads the file as it is.
2. Open Word → Blank document → Mailings tab → Start Mail Merge → E-mail Messages.
3. Select Recipients → Use an Existing List → choose the downloaded file → Open. If Word asks about the separator, accept the default (comma) and OK.
4. In the console click Copy email text and paste it into the document. It contains «FirstName» and «Link» as plain text; delete each one and replace it with Insert Merge Field → FirstName and Insert Merge Field → Link, so Word shows them as real fields (they turn grey when you click them).
5. Click Preview Results to see the first person’s email with their real name and link. Use the arrows to check a second one.
6. Finish & Merge → Send E-mail Messages. Set To: Email, paste the subject into Subject line, set Mail format to HTML, leave Send records on All, click OK.
7. Outlook sends one email per row; watch the Outbox empty. Open the Sent folder and check one email shows a real link, not «Link».

5. Microsoft Teams or Slack#

For teams that live in chat, a direct message per person is quick and feels natural. Never post the list in a channel: each link is personal and works once.

1. In the Send the links card, Teams or Slack tab, find the person in the table and click Copy message. The whole invitation, with their name and their link, is on your clipboard.
2. Open a direct message with that person in Teams or Slack, paste, send.
3. Next person. The table remembers who you have done: a “sent” mark appears against each.

For more than about 40 people, an email merge (sections 3 or 4) is faster; a chat message per person is best kept for small teams or for the reminders at the end.

6. One by one, from any email app#

No mail merge, no spreadsheet: works with any email app, including personal Gmail, Apple Mail, Thunderbird and the new Outlook.

1. In the Send the links card, One by one tab, click Email next to a person. Your email app opens a new message with their address, the subject and the whole invitation filled in, link included.
2. Press Send. Come back to the console; the row is marked sent.
3. Next person. Ten people take about a minute.

If the Email button opens the wrong app, set your preferred one as the default mail app in your operating system’s settings, or use Copy message and paste into a new email yourself.

7. Open-link campaigns#

An open-link campaign has one link for everyone, so there is nothing to pair. The Send the link card shows it with Copy link, Open in my email app and Copy email text. Send it to a distribution list, post it in a channel, or print it as a QR code for a notice board. Counts are approximate because anyone with the link can take part.

8. What the email says#

The default text below is written to be trusted: it says who is running the check, how long it takes, that there is no pass or fail, and what is recorded. Edit it in Step 2 of the card; the placeholders in braces are filled in per person by whichever tool you use.

Subject: Can you spot the scam? A short check from {Company}

Hi {FirstName},

We are running a short scam-awareness check across the team. It takes about {Minutes} minutes and there is no pass or fail; it shows us where a little extra help would be useful.

Your personal link (it works once, so please do not forward it):
{Link}

It expires {Expires}. It is anonymous: we see the overall numbers, never who answered what.

Thanks!

• Send it from a person, not a shared mailbox. The best completion rates come from a manager’s own address with a one-line note on top.
• Tell people it is coming, in a team meeting or a channel post the day before. An unexpected “click this link” email is what the check trains people to distrust.
• Do not add urgency. “Please complete by Friday” is fine; “URGENT: ACTION REQUIRED” is the pattern of the emails in the test.

9. Reminders#

Links stay valid until the expiry you set when creating the campaign. With a connected Microsoft 365 mailbox, reminders are automatic (section 2). Otherwise: on a named campaign the results page shows who has not opened or not finished; use the One by one or Teams or Slack tab to nudge just those people. On an anonymous campaign nobody knows who is missing, so send one reminder to everyone: a short reply-all to your original message, “if you have not done it yet, your link is still in the email below”, works well.

10. Troubleshooting#