Microsoft ATP

Question

Microsoft ATP

DaNmAN 201

Hi

One of our suppliers emails to users in the event of an emergency and the emails have two links on them the user can click.

I am ok

I am not ok

When the user clicks one the links it generated an email response.

Recently we are receiving response emails from users who are not clicking on these links.

It is happening automatically.

I believe ATP when scanning these links will open them first and this is what has been causing our issue. I have seen this issue before with an unsubscribe button being scanned and activated.

How to stop this? The supplier is suggesting we need to whitelist certain IP's to resolve

Has anyone else seen this behaviour with ATP?

2 answers

Your answer

Answer 1

Andy David - MVP 157.8K MVP Volunteer Moderator

I haven't but if you believe that the ATP scans are firing these off, you could exclude ATP SafeLink checking by creating a mail flow rule to bypass it when sent from that supplier:

https://support.knowbe4.com/hc/en-us/articles/115004326408-How-to-Bypass-Safe-Link-Attachment-Processing-of-Advanced-Threat-Protection-ATP-

ATP Link Bypass Rule

Answer 2

Lydia Zhou - MSFT 2,386 Microsoft Employee

@DaNmAN Based on the official document How ATP Safe Links works with URLs in email, the ATP Safe Links feature immediately checks the URL before opening the website, but it doesn't explain too much about how ATP Safe Links check the URL. At present, we cannot make sure the ATP Safe Links feature opens the link and an email response generates. Additionally, you can contact the supplier to see if they have any records or detailed data about who has opened these links.

You also can take AndyDavid's suggestion into consideration. We can try to bypass ATP Safe Links for some specific emails, then check if the issue persists.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Lydia Zhou - MSFT 2,386 Reputation points Microsoft Employee

2020-09-04T06:47:34.373+00:00

@DaNmAN
Just checking in to see if above information was helpful.
Does the transport rule work for you? Please let us know if you would like further assistance.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Lydia Zhou - MSFT 2,386 Reputation points Microsoft Employee

2020-09-08T08:40:37.307+00:00

@DaNmAN

Is there any update on this thread?
If you have solved your problem, could you share with us? Maybe it will help more people with similar problems.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
DaNmAN 201 Reputation points

2020-09-16T08:51:40.77+00:00

Hi

I have not solved this as yet but will let you know what happens
Lydia Zhou - MSFT 2,386 Reputation points Microsoft Employee

2020-09-17T02:44:02.773+00:00

That's OK. If there is anything else we can do for you, please feel free to post in the forum.
Hope everything works well on your side.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Microsoft ATP

2 answers

Your answer