"Something went wrong. Primary and secondary data missing" when viewing email submission

Cause 1: The "Race Condition" - Processing Latency (Most Likely Cause)

This is, by far, the most common reason for this error. When you submit an email, a complex backend process kicks off in the Microsoft 365 cloud. It's not a single, instantaneous action.

1. Submission Received: Your submission is received by the Defender service.
2. Metadata Extraction: The system immediately creates a record for the submission and extracts basic metadata (sender, recipient, subject, etc.). This is the "primary data."
3. Deep Analysis & Detonation: In parallel, the email and its attachments are sent to a sandbox environment for deep analysis. This involves:
   • Detonating any attachments to see what they do.
   • Following any URLs to see where they lead.
   • Analyzing the email headers and body for signs of phishing.
   • This deep analysis generates the rich "secondary data" (like screenshots of the malicious site, file hashes of dropped malware, network connections made, etc.).
4. Data Correlation: The results of the deep analysis are then correlated back to the original submission record.

The error "Primary and secondary data missing" often occurs when you try to view the submission after Step 2 but before Step 4 is complete.

• Why it happens: The portal's user interface knows a submission exists, but when it tries to fetch the detailed analysis results, they aren't available yet. The deep analysis can take anywhere from a few minutes to sometimes 15-20 minutes, especially if the attachment is complex or the sandbox environment is under heavy load.
• Why it's sporadic: It happens more frequently when the backend services are busy or when you click to view the submission very quickly after submitting it. For simple, known-bad emails, the analysis is fast, and you never see the error. For new or complex threats, it takes longer, increasing the chance you'll hit this timing window.

Solution: In most cases, the solution is simply to wait 10-15 minutes and then refresh the page or navigate back to the submission. The detailed analysis will have likely completed, and all the data will be available.

Cause 2: Email Content or Formatting Issues

Sometimes, the structure of the email itself can interfere with the analysis engine.

• Encrypted or Protected Emails: If the email was encrypted with a technology that Microsoft's sandbox cannot decrypt (e.g., a non-Microsoft S/MIME certificate or a password-protected ZIP file), the analysis engine cannot inspect the content. It can't detonate the attachment or follow the links, so no "secondary data" is generated.
• Bizarre or Malformed MIME Content: Emails are complex, multi-part objects (MIME format). A very unusual or malformed email structure could potentially cause the parsing engine to fail, preventing it from extracting the content needed for deep analysis.
• In-transit Modification: In rare cases, a mail flow rule or a third-party email gateway between the original recipient and the submission mailbox could alter the email in a way that strips or corrupts the content before it reaches Defender.

Solution: If you consistently see this error for emails from a specific source or with a specific type of attachment, try to get a copy of the original email (.eml or .msg file) and inspect it to see if there's anything unusual about its format or if it's encrypted.

Cause 3: Transient Backend Service Issues

While less common, it's always possible that there is a temporary issue with a specific part of the Defender backend service.

• How it happens: The submission service might be working fine, but the specific sandbox or URL reputation service it relies on could be experiencing a temporary problem. This would prevent the secondary data from being generated and attached to the submission record.
• How to check: You can check the Microsoft 365 Service Health Dashboard in the M365 Admin Center. Look for any active incidents related to "Microsoft Defender for Office 365" or "Exchange Online Protection." Often, an incident will be reported with a title like "Users may experience delays or failures in viewing submission details."

Solution: If you suspect a service issue, there's not much you can do other than wait for Microsoft to resolve it. Resubmitting the email later, after the incident is resolved, will usually work.

Summary: What to Do When You See the Error

1. Wait and Refresh: This is the first and most important step. Give it at least 15 minutes. This solves the problem 90% of the time.
2. Check for Encryption: Was the submitted email encrypted or was the malicious payload inside a password-protected archive? If so, the analysis will fail, and this error is expected.
3. Check the Service Health Dashboard: Look for any active Microsoft-side incidents that could be affecting the analysis pipeline.
4. Resubmit (If Necessary): If after an hour the data is still missing and there are no service health issues, you can try resubmitting the email.

The sporadic nature of the error (5-10% of the time) strongly suggests that the processing latency (Cause 1) is the most likely culprit in your case. It's a frustrating but usually benign side effect of a very complex and powerful analysis system working in the background.