Forum Discussion

StefanKi's avatar
StefanKi
Iron Contributor
May 05, 2022

Keep "bad" mails for analysis but not in users mailbox

Hello,

I configured EOP rules. But there are still bad mails which go through the rules and go in the mailboxes of the colleagues.

For an analysis I would like to keep these mails. But they should not be in the mailboxes of the users.

How can I proceed here?

 

Regards

Stefan

investigation
microsoft 365 defender
remediation
  • Ash_Gardiner's avatar
    Ash_Gardiner
    Iron Contributor
    May 23, 2022
    Hi Stefan,

    If items are getting through that you expect to be blocked, take a look at the threat policies configuration analyzer and see what you can tune. https://security.microsoft.com/configurationAnalyzer.
    There are probably some thresholds you can adjust to reduce instances of bad mail getting through.
    When you say it is going in the mailbox, do you mean the inbox or junk mail? By changing anti-spam policy "actions" section, you can quarantine items instead of allowing them to go to a user's junk mail folder.

    Thanks, Ash

Resources