Forum Discussion
Phishing Filter - M365 ATP - false positives blocked or clear spam messages get into inbox.
We implemented all best practices (if suitable).
Now "internal mails" to external are filtered as SPAM (highest number 9).
How can internal mail be marked as spam? They are normal responses to mails.
These are filtered - but mails like these still coming through:
At this moment our Sophos UTM was a better filter than Office ATP - as we needed about 20% of the resources to manage it.
Is there any possibility to check how the SPAM score was calculated?
eg.
Score starts at 5
SPF ok -1 points
DKIM passed -1 Point
20 mails in the past 1h +1
= 4
?
- Not as far as I know
Such things probably aren't published in order to protect the inner workings of ATPThanks for your fast answer.
We have so many cases with false positives that we might just make more internal trainings and set the spam recognition lower.
Current case:
Normal mails from customer is received fine
Teams meetings are sent to quarantine. No special configuration (no picture, no disclaimer, no custom help page)
Customer uses M365 like us
One difference is, that a special character in the name of the customer is recognized in normal mail and in Teams meeting not.
- Could you check the spam header why it's being blocked?
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-message-headers?view=o365-worldwide
