question

MohammedBinAlewa-0160 avatar image
0 Votes"
MohammedBinAlewa-0160 asked YukiSun-MSFT commented

problem with anti-phishing policy

I've enabled anti-phishing policy in our company (the default policy), applied to all users , and we configured that the Phishing message will Quarantined .

the problem is :
sometimes the same phishing email sent to two users (for example), one of these users receive this email normally but the other user don't receive anything, when we review the quarantined massages we found that the anti-phishing policy marked this email as a phishing email and prevented it to delivery to the second user !!

the question is, why anti-phishing policy prevented the email to delivered for one user and another one no ?

office-exchange-server-administration
· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @MohammedBinAlewa-0160,

I've added the [office-exchange-server-administration] tag since this question is more appropriate there.

Best regards,
Tom Jebo
Sr Escalation Engineer
Microsoft Open Specifications Support

1 Vote 1 ·

Hi @MohammedBinAlewa-0160

If possible, I'd suggest try picking some of these messages, comparing the message headers of both the quarantined one and the mail in the second user's inbox to see if there would be any difference. To view the message headers, you can use the Message Header Analyzer tool. And you can pay more attention to the anti-spam and anti-phishing related headers when doing the comparison. For more information, see Tune anti-phishing protection-Inspect the message headers.

In addition, it's also recommended to use the Submissions portal in the Microsoft 365 Defender portal to submit the problemati email messages to Microsoft for scanning. More details can be found via Use the Submissions portal to submit suspected spam, phish, URLs, and files to Microsoft


If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

0 Votes 0 ·

Hi @MohammedBinAlewa-0160

Just circling back to see how things are going on with this thread. Should you still need help on this, feel free to post back.


If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


0 Votes 0 ·

0 Answers