Admin action - File type block even though no attachment exists

Question

Every now and then we get an email quarantined due to Admin action - File type block. When I look into the details I can see that there are no attachments, although when I preview the message, it lists an attachment as cid695035692FE85F49B5BBB7E562A34966@AUSP282.PROD.OUTLOOK.COM (161.47 KB).

Why is Exchange adding this as an attachment? It seems to be a false positive as a result. How do I accommodate such an attachment in my rules?

Answer 1

Hi @RobM,

Welcome to the Microsoft Q&A platform!

According to your description, it seems like you are dealing with a scenario where Microsoft Exchange or an email security gateway is flagging an email due to its attachment policies, potentially due to a file type that is not allowed per your organization's email policies.

The "cid:" part in the file name indicates that this "attachment" is actually a Content-ID, which is used in HTML emails to embed images (or other files) directly within the email rather than attaching them separately. These embedded images are part of the email's MIME content and are not typically considered attachments in the traditional sense; however, some security systems might still flag them because they technically are files being sent along with the email.

If these are false positives and you want to accommodate such files, you would need to adjust your email security gateway or Exchange transport rules to allow these types of embedded images. Here's how you might approach this:

1. Check your current email attachment policies to understand why these types of emails are being quarantined. It might be due to size, file extension, or some other filter that is interpreting the embedded content incorrectly.
2. Adjust your transport rules to allow certain types of content. Be cautious with this, as you don't want to inadvertently allow actual malicious content through.
3. If these emails are coming from a trusted source, you might consider whitelisting the sender or domain to prevent these emails from getting flagged.
4. If the quarantine is due specifically to a block on certain file types, you can modify the rule to allow the specific file type in question or to handle embedded content differently.

Please feel free to contact me if you have any queries.

Best,

Jake Zhang