Home

Teams email notifications quarantined as phish

%3CLINGO-SUB%20id%3D%22lingo-sub-307201%22%20slang%3D%22en-US%22%3ETeams%20email%20notifications%20quarantined%20as%20phish%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-307201%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20subscribe%20to%20Office%20365%20and%20use%20both%20Teams%20and%20Outlook%2FExchange.%20Some%20email%20notifications%20from%20Teams%20(e.g.%20when%20message%20is%20posted%20in%20a%20Channel)%20get%20quarantined%20due%20to%20phishing%20suspicion.%20These%20are%20emails%20sent%20by%20noreply%40email.teams.microsoft.com.%20I%20checked%20our%20Anti-phishing%20policy%20(from%20Security%20%26amp%3B%20Compliance%20dashboard)%20and%20I%20can't%20see%20anything%20that%20would%20cause%20Teams%20notification%20to%20be%20quarantined.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAppreciate%20if%20anybody%20can%20help.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-307201%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdministrator%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EBest%20Practices%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Teams%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-307308%22%20slang%3D%22en-US%22%3ERe%3A%20Teams%20email%20notifications%20quarantined%20as%20phish%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-307308%22%20slang%3D%22en-US%22%3E%3CP%3EProbably%20a%20case%20of%20a%20false-positive%2C%20but%20you%20need%20to%20check%20the%20headers%20and%20message%20trace%20to%20get%20additional%20info.%20Report%20the%20messages%20to%20Microsoft%2C%20so%20they%20adjust%20the%20filters.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Andre Siregar
Occasional Contributor

We subscribe to Office 365 and use both Teams and Outlook/Exchange. Some email notifications from Teams (e.g. when message is posted in a Channel) get quarantined due to phishing suspicion. These are emails sent by noreply@email.teams.microsoft.com. I checked our Anti-phishing policy (from Security & Compliance dashboard) and I can't see anything that would cause Teams notification to be quarantined.

 

Appreciate if anybody can help.

1 Reply

Probably a case of a false-positive, but you need to check the headers and message trace to get additional info. Report the messages to Microsoft, so they adjust the filters.