I've done extensive investigation and research tonight and may have found the issue. When a user sends an email to an external recipient with a qualifying attachment (pdf, docx, etc), the message is submitted to moderators automatically by the transport rules for approval
- The system attendant/arbitration mailbox sends the approval request to a moderator for approval, and the message is approved and released for delivery
- I noticed when this happens, the message is dropped or blocked and no information is provided in the Explorer portal at security.microsoft.com why
- The moderator receives a duplicate approval request immediately after, approves it and the message is released for delivery and the final status is delivered, or the Latest delivery location shows: On-prem/external
I'm unable to find any reason anywhere why these messages are being dropped/blocked, and its only happening when the duplicate moderation requests arrive. I kept asking myself, "Why isnt anyone noticing that the recipients are receiving their emails, and I noticed right after the dropped or blocked status, the same message shows again as delivered.
I cant find anything online about this, does this mean anything to you? We had a heated meeting with our support engineer covering the case today; they simply are not able to come up with anything here and the only reason we are this far is because I'm doing all of the work.