Home

Exchange hybrid with on-prem mail relay - ATP delay

%3CLINGO-SUB%20id%3D%22lingo-sub-692996%22%20slang%3D%22en-US%22%3EExchange%20hybrid%20with%20on-prem%20mail%20relay%20-%20ATP%20delay%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-692996%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20everyone%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20seeing%20delays%20when%20messages%20from%20our%20on%20premise%20mail%20relay%20(think%20scan%20to%20email%2C%20on%20premise%20applications)%20are%20sent%20to%20our%20tenant%20O365%20user%20mailboxes.%26nbsp%3B%20This%20relay%20as%20well%20as%20other%20mailboxes%20need%20to%20stay%20on%20premise.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EATP%20is%20causing%20this%20delay%2C%20is%20there%20a%20way%20to%20bypass%20ATP%20for%20messages%20sent%20from%20our%20on%20prem%20mail%20environment%20to%20tenant%20mailboxes%3F%26nbsp%3B%20Dynamic%20Delivery%20isn't%20really%20an%20option%20because%20users%20expect%20to%20get%20their%20scanned%20attachments%20when%20they%20receive%20the%20email.%26nbsp%3B%20The%20following%20link%20indicates%20you%20can%20turn%20it%20off%20for%20specific%20senders%20or%20smart%20hosts%2C%20which%20would%20be%20perfect%2C%20but%20I%20only%20see%20recipient%20options%20in%20the%20Safe%20Attachments%20policies.%26nbsp%3B%20Maybe%20I'm%20missing%20something.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fset-up-atp-safe-attachments-policies%26nbsp%3B%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fset-up-atp-safe-attachments-policies%26nbsp%3B%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3E%3CSTRONG%3EOff%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FTD%3E%3CTD%3EDoes%20not%20scan%20attachments%20for%20malware%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3EDoes%20not%20delay%20message%20delivery%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FTD%3E%3CTD%3ETurn%20scanning%20off%20for%20internal%20senders%2C%20scanners%2C%20faxes%2C%20or%20smart%20hosts%20that%20will%20only%20send%20known%2C%20good%20attachments%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3EPrevent%20unnecessary%20delays%20in%20routing%20internal%20mail%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSTRONG%3EThis%20option%20is%20not%20recommended%20for%20most%20users.%20It%20enables%20you%20to%20turn%20ATP%20Safe%20Attachments%20scanning%20off%20for%20a%20small%20group%20of%20internal%20senders.%3C%2FSTRONG%3E%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-692996%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-693082%22%20slang%3D%22en-US%22%3ERe%3A%20Exchange%20hybrid%20with%20on-prem%20mail%20relay%20-%20ATP%20delay%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-693082%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20are%20you%20routing%20those%20messages%3F%20You%20say%20you%20are%20in%20Hybrid%2C%20if%20they%20are%20passing%20through%20the%20Hybrid%20connector%20they%20should%20be%20bypassing%20ATP.%20You%20can%20also%20create%20a%20rule%20to%20bypass%20it%2C%20or%20adjust%20the%20ATP%20policy.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-693120%22%20slang%3D%22en-US%22%3ERe%3A%20Exchange%20hybrid%20with%20on-prem%20mail%20relay%20-%20ATP%20delay%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-693120%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3BMy%20apologies%20-%20I%20read%20my%20headers%20wrong.%26nbsp%3B%20The%20delay%20appears%20to%20be%20at%20the%20Edge%20transport.%26nbsp%3B%20We're%20in%20the%20middle%20of%20ongoing%20migrations%2C%20I'm%20wondering%20if%20we%20have%20a%20throttling%20problem.%26nbsp%3B%20Thanks%20for%20the%20response!%3C%2FP%3E%3C%2FLINGO-BODY%3E
David Phillips
Super Contributor

Hi everyone,

 

We are seeing delays when messages from our on premise mail relay (think scan to email, on premise applications) are sent to our tenant O365 user mailboxes.  This relay as well as other mailboxes need to stay on premise. 

 

ATP is causing this delay, is there a way to bypass ATP for messages sent from our on prem mail environment to tenant mailboxes?  Dynamic Delivery isn't really an option because users expect to get their scanned attachments when they receive the email.  The following link indicates you can turn it off for specific senders or smart hosts, which would be perfect, but I only see recipient options in the Safe Attachments policies.  Maybe I'm missing something.

 

https://docs.microsoft.com/en-us/office365/securitycompliance/set-up-atp-safe-attachments-policies 

 

 

Off Does not scan attachments for malware 
Does not delay message delivery 
Turn scanning off for internal senders, scanners, faxes, or smart hosts that will only send known, good attachments 
Prevent unnecessary delays in routing internal mail 
This option is not recommended for most users. It enables you to turn ATP Safe Attachments scanning off for a small group of internal senders.

 

Thanks!

2 Replies

How are you routing those messages? You say you are in Hybrid, if they are passing through the Hybrid connector they should be bypassing ATP. You can also create a rule to bypass it, or adjust the ATP policy.

@Vasil Michev My apologies - I read my headers wrong.  The delay appears to be at the Edge transport.  We're in the middle of ongoing migrations, I'm wondering if we have a throttling problem.  Thanks for the response!