How to remove Hoxhunt implementation

 

Introduction

There may come a day when you might need to remove Hoxhunt service partially or completely in your organization. The removal of the Hoxhunt implementation will depend on your initial implementation, which in turn will depend on your technical environment.

Hoxhunt removal includes 5 steps:

1. Remove the Hoxhunt add-in / plugin / button from your employees' inboxes

2. Remove all mail flow rules associated with Hoxhunt (allowlisting, ETRs, email delivery settings, etc.)

3. If relevant - Remove allowlisting in VPNs, proxies, firewalls and link scanners

4. If relevant - Remove SSO implementation

5. If relevant - Remove SCIM implementation

 

Please find short checklists below for our two main supported environments

Remove Hoxhunt from Outlook environments

Remove Hoxhunt from Gmail environments

NOTE: You may have additional implementation related to Hoxhunt, so the lists might not be exhaustive. Please consult Hoxhunt Support if you have any questions or doubts.

 

Remove Hoxhunt from Exchange environments

1. Remove Hoxhunt add-in
2.A. Remove mail flow rules (ETRs) and Advanced Delivery configuration.
2.B. If relevant - Remove Receive Connector

3. If relevant - Remove allowlisting in proxies, VPNs, firewalls and link scanners

4. If relevant – Remove Hoxhunt SSO

5. If relevant - Remove Hoxhunt SCIM

 

1. Remove Hoxhunt add-in

Removing the Hoxhunt add-in depends on the way Hoxhunt add-in has been deployed to the users. Please follow instructions appropriate to you:

1.A. Add-in was distributed via SCCM or similar system from an MSI package

  1. Please uninstall Hoxhunt add-in from your employees by following your internal guidelines.

1.B. Add-in was distributed via Exchange Admin Center (on-premise Exchange)

  1. Log in to Exchange Admin Center and navigate to organization > apps
  2. Select Hoxhunt add-in from the list and click Remove (trash can).

The add-in will be removed from all users automatically. This may take several hours so please be patient.

1.C. Add-in was distributed via Centralized Deployment (Microsoft 365 Admin Center)

  1. Log in to Microsoft 365 Admin Center and navigate to Services > Add-ins or Integrated Apps
  2. Click Hoxhunt add-in in the list. A side pane opens with add-in details.
  3. Click Remove add-in at the bottom of the side pane.

The add-in will be removed from all users automatically. This may take up to 24 hours to complete for all employees.

 

2. Remove allowlisting and mail flow rules

2.A. Remove allowlisting and mail flow rules in Exchange

(applies to: all Exchange servers, gateways and security filters)

Please remove any Hoxhunt-related allowlisting and mail flow rules from all Exchange servers (including on-premise Exchange Servers and Exchange Online).

  1. Log in to Exchange Admin Center and/or M365 Admin Center > Exchange.
  2. Navigate to protection > connection filter. Remove the following IP addresses from IP Allow list: 193.3.183.0/25, 139.12.94 and 35.156.0.138
  3. Navigate to mail flow > rules. Remove any rules related to Hoxhunt.
  4. Navigate to https://security.microsoft.com/advanceddelivery and remove the configuration for Hoxhunt.

You can review the guidelines for the allowlisting here:

Allowing Hoxhunt training emails to be delivered uninterrupted to Microsoft 365 / On-premise Exchange mailboxes

Configuring Advanced Delivery for Hoxhunt

IMPORTANT: You may have configured Hoxhunt differently as described here and Hoxhunt's implementation documentation. Please take extra care and check your internal technical documentation regarding Hoxhunt.

 

2.B. Remove allowlisting and mail flow rules in other mail filtering systems

If you have additional systems on your message path, please make sure you remove Hoxhunt-related bypass rules in those systems as well. This includes possible allowlisting of Hoxhunt's sender domains and fail URLs for Hoxhunt training purposes. You can see implementation guides for a few commonly used mail filtering systems here: Allow/whitelisting of additional mail filtering systems

If you are unsure how to remove the allowlisting, please reach out to the vendor in question for guidance.

If you are unsure of which sender domains are part of Hoxhunt training, please reach out to Hoxhunt Support for a comprehensive list.

 

2.C. Optional - Remove Partner Receive Connector

Your organization may have implemented a Partner Receive Connector in order to facilitate training email delivery from Hoxhunt to your employees.

  1. Log in to Exchange Admin Center or M365 Admin Center > Exchange.
  2. Navigate to mail flow > connectors. Remove the connector related to Hoxhunt.

 

3. If relevant - Remove allowlisting in proxies, VPNs, firewalls and link scanners

The steps needed will depend on your technical environment and the allowlisting you initially did to implement Hoxhunt. You can see the standard implementation guides here:

Allow/whitelisting proxies, VPNs and firewalls overview

If you are unsure how to remove the allowlisting, please reach out to the vendor in question for guidance.

 

4. If relevant – Remove Hoxhunt SSO

Do we have this? Learn more about Hoxhunt SSO

Removing SSO depends on the way Hoxhunt SSO was implemented. These instructions refer to how to Azure AD SSO App and AD FS SSO can be removed.

 

4.A. Azure AD SSO

  • Log in to the Azure Portal with your credentials. Go to Azure Active Directory.
  • Click Enterprise Applications.
  • Click Hoxhunt SSO App in the list.
  • Navigate to Properties and click Delete (trash can).

4.B. AD FS SSO

  • Log in to AD FS 2.0 Console.
  • Navigate to Trusted Relationships > Relying Party Trusts.
  • Select Hoxhunt and click Delete.

 

5. If relevant - Remove Hoxhunt SCIM

Do we have this? Learn more about Hoxhunt and automated user provisioning

Azure AD SCIM

  • Log in to the Azure Portal with your credentials. Go to Azure Active Directory.
  • Click Enterprise Applications.
  • Click Hoxhunt SCIM App in the list.
  • Navigate to Properties and click Delete (trash can).

 

Remove Hoxhunt from Gmail environments

1. Remove Hoxhunt add-in
2. Remove allowlisting and mail flow rules

3. If relevant - Remove allowlisting in proxies, VPNs, firewalls and link scanners

4. If relevant – Remove Hoxhunt SSO

5. If relevant - Remove Hoxhunt SCIM

 

1. Remove Hoxhunt add-in

Removing the Hoxhunt add-in depends on the way Hoxhunt add-in has been deployed to the users. Please follow instructions appropriate to you.

 

1.A. Remove private Hoxhunt Gmail App

A) Disable private Hoxhunt Gmail App’s for all users

  1. Go to admin.google.com and navigate to Apps > G Suite Marketplace apps.

  2. Click Hoxhunt for Gmail in the apps list, select OFF for everyone and click SAVE.

Private Hoxhunt Gmail App is now uninstalled from all users.

B) Remove Hoxhunt for Gmail Cloud Project

  1. Go to console.cloud.google.com and you'll land on Dashboard/Home view.

  2. Click Hoxhunt for Gmail at the top-most blue bar.

  3. Click the kebab menu in the top-right corner and select Manage resources > Hoxhunt for Gmail and click DELETE.

  4. Enter the Project ID visible in the underlying view (“Hoxhunt for Gmail”) and click Shut down to complete removal.

Cloud Project will be removed by Google in the coming weeks.

C) Remove copy of Hoxhunt add-on loader

  1. Navigate to Google Drive.

  2. Remove your copy of Hoxhunt addon loader.

Hoxhunt will stop sharing Hoxhunt for Gmail and Hoxhunt addon loader in a moment.

 

1.B. Remove Hoxhunt Google Workspace Add-on

1. Navigate to Google Admin Console at https://admin.google.com/.

2. From the main menu on the left, navigate to Apps > Google Workspace Marketplace Apps.

3. Select the Hoxhunt App.

4. Choose Delete App on the left.

 

The Hoxhunt button will be removed from your employees Gmails within the next 24 hours.

 

 

2. Remove allowlisting and mail flow rules

Depending on how you implemented Hoxhunt, you will either need to remove the allowlisting in Gmail or remove the API Delivery. Please choose the guide below as relevant to your implementation.

 

2.A. Remove allowlisting in Gmail

If you have implemented Hoxhunt before October 2021, this is the likely method you have used.

1. Log in to Google Admin Console at https://admin.google.com/.

2. Navigate to Apps > Google Workspace > Gmail.

3. Select Spam, phishing and malware.

4. Choose the edit icon (pen) on Email whitelist and remove the following IP addresses from Email whitelist field: 193.3.183.0/25, 37.139.12.94 and 35.156.0.138.

5. Choose Save.

6. Choose the edit icon (pen) on Inbound gateway and remove the following IP addresses from Email whitelist field: 193.3.183.0/25, 37.139.12.94 and 35.156.0.138. If you don't use the Inbound gateway for anything else, you can disable the feature.

You have now removed the email allowlisting.

 

2.B. Remove API Delivery

If you have implemented Hoxhunt after October 2021, this is the likely method you have used.

1. Go to https://admin.hoxhunt.com/settings/email-delivery.

2. Locate Gmail API Integration section.

3. Toggle Use Gmail API Integration toggle to OFF position.

4. Next, navigate to Domain Delegation Settings in Google Workspace.

5. Remove the API Client that matches the Client Id and the Required scopes in Hoxhunt Admin.

The below screenshot shows the Gmail API Integration turned off and where the Client Id and Required scopes can be found.

gmail_api_delivery_off.png

 

2.C. Remove allowlisting and mail flow rules in other mail filtering systems

If you have additional systems on your message path, please make sure you remove Hoxhunt-related bypass rules in those systems as well. This includes possible allowlisting of Hoxhunt's sender domains and fail URLs for Hoxhunt training purposes. You can see implementation guides for a few commonly used mail filtering systems here: Allow/whitelisting of additional mail filtering systems

If you are unsure how to remove the allowlisting, please reach out to the vendor in question for guidance.

If you are unsure of which sender domains are part of Hoxhunt training, please reach out to Hoxhunt Support for a comprehensive list.

 

3. If relevant - Remove allowlisting in proxies, VPNs, firewalls and link scanners

The steps needed will depend on your technical environment and the allowlisting you initially did to implement Hoxhunt. You can see the standard implementation guides here:

Allow/whitelisting proxies, VPNs and firewalls overview

If you are unsure how to remove the allowlisting, please reach out to the vendor in question for guidance.

If you are unsure of which sender domains are part of Hoxhunt training, please reach out to Hoxhunt Support for a comprehensive list.

 

4. If relevant – Remove Hoxhunt SSO

Do we have this? Learn more about Hoxhunt SSO

 

4.A. Remove Google Workspace SSO

1. Log in to Google Admin Console.

2. Choose Apps.

3. Chose Web and mobile apps

4. Choose the Hoxhunt SAML application from the list

5. Choose Delete app

 

4.A. Remove OKTA SSO

Undo the steps done in this article: User Management: Configuring Okta SSO and SCIM

 

5. If relevant – Remove Hoxhunt SCIM

Do we have this? Learn more about Hoxhunt and automated user provisioning

 

5.A. Remove OKTA SCIM

Undo the steps done in this article: User Management: Configuring Okta SSO and SCIM

 

Questions?

If you have any questions about removing the Hoxhunt implementation in your environment, please don't hesitate to reach out to our support team at support@hoxhunt.com 

Was this article helpful?

4 out of 5 found this helpful

Have more questions? Submit a request