ATP Safe Links is blocking legitimate OneDrive for Business links shared by our users internally.
We recently had a compromised user which was blocked by the anti-spam rules as expected.
The malicious actor(s) planted a PDF document (named "microsoft.pdf") in the user's OneDrive with an embedded link to a malicious site. A link to that document was then shared with several users. Anti-spam policy filter saw the number of mails and blocked the user. The users who received the link thought it was a legitimate link shared by the internal user and clicked the link. However, the link was blocked in the browser by the ATP Safe Links.
So far so good. ATP Safe Links IMHO identified the deep linked document as malicious and blocked the users browsing to the OneDrive link. Amazing.
However, pretty soon, now all sharing links are getting blocked by the ATP Safe Links. Somehow, it seems, ATP Safe Links has recorded the OneDrive URL as malicious and is now blocking all legitimate internal sharing links.
Interestingly, copy-pasting the raw unwrapped link in the browser works. Only the wrapped links are getting blocked.
Has anybody else experienced this? I've opened a ticket with support and am waiting for them to check it out. Meanwhile, I thought maybe someone who has experienced something similar may help with more information here.
Below is a screenshot of the document which was planted in the user's OneDrive with the name "Microsoft.pdf". The "Access Document" button is the link to an actual external malicious site (which is blocked by browser's native functionality anyway).
