365 ATP scanning time

PS_83 

I find most of the time 2-5 minutes and the attachment is available. 

I ended up turning off the setting that delivered the email without the attachment due to complaints from users they couldn't open it.  It seemed like a good idea when I set it up but the users got frustrated. 

Now the email gets delivered once the attachment has been scanned and the only time they notice the delay is with emails from the copier which no longer arrive instantly.

For your second question, try a mail flow rule which sets the message header to X-MS-Exchange-Organization-SkipSafeAttachmentProcessing and the value to 1 and set it to apply under specific conditions such as sender domain.