User is getting phishing mail , how to stop getting it auto released

[khan_mahindra]

Hi All,

A business user is getting phishing mail and he keeps marking as phishing but after some times it is getting auto released from quarantine center office365 because it does not find anything bad thoug it is nto legit at all.

what should be a good practice to block completely 

[#2]

Hello Khan,

Blocking phishing emails can be very tricky as it comes from various sources and different domains. please see the link below

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/tuning-anti-phishing?vie...

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-pol...

[#3]

Hi there Khan!
What does your current threat policies (Anti-Spam, Phishing, Malware) look like? What's the current threshold and action settings?

This user that gets the spam messages, can you see a pattern in the spam emails? Does the user receive more spam than other people?

Perhaps you need to change the aggresiveness of existing policies or create a new policy for this and other high targeted users.

Happy to help you further!

Kind Regards
Oliwer