Share via

Anti-phish policies in Defender are blocking some scans with PII

AustinBits 0 Reputation points
2025-04-10T18:47:00.5966667+00:00

We are having a percentage of our scans from the email address associated with our scanner that are being sent to Quarantine. Examining the list in defender explorer, it appears that the anti-fishing and anti-spam. policies are sending our scans to Quarantine.

In some instances, the scale. will show as email delivered. also with a message that email failed and the user never got the scan. another issue is the spf / dmarc / dkim is failing. Any ideas on why a small percentage of scans are getting quarantined by anti phish

scan email reason quarantine2 antiphish

scan email reason quarantine3 antiphish

Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
2,273 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  2. Andy David - MVP 155.2K Reputation points MVP
    2025-04-10T18:52:50.76+00:00

    You can submit those to hopefully allow in the TABL:

    https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about#allow-entries-in-the-tenant-allowblock-list

    If those messages are failing the auth checks, Im not surprised they get blocked however

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.