Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

External Outlook Items getting added as Tentative automatically

Copper Contributor

We have an issue where external spammers are sending "outlook items" that are getting automatically added to users calendar's as tentative, even though we have "ProcessExternal Meeting Messages" set to False. How can I stop these? Defender is not detecting them, and my fear is that since they show on the calendar, that people will start clicking on links whenever these meetings are set for. 

 

Here's an example of one of the message headers:

 

Received: from BL1P164MB0108.NAMP164.PROD.OUTLOOK.COM (2603:10b6:208:303::14) by SJ0P164MB0100.NAMP164.PROD.OUTLOOK.COM with HTTPS; Mon, 1 Jan 2024 22:24:52 +0000
Received: from BN0PR04CA0124.namprd04.prod.outlook.com (2603:10b6:408:ed::9) by BL1P164MB0108.NAMP164.PROD.OUTLOOK.COM (2603:10b6:208:303::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.25; Mon, 1 Jan 2024 22:24:33 +0000
Received: from BN8NAM04FT022.eop-NAM04.prod.protection.outlook.com (2603:10b6:408:ed:cafe::41) by BN0PR04CA0124.outlook.office365.com (2603:10b6:408:ed::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.25 via Frontend Transport; Mon, 1 Jan 2024 22:24:33 +0000
Received: from NAM12-DM6-obe.outbound.protection.outlook.com (40.107.243.76) by BN8NAM04FT022.mail.protection.outlook.com (10.13.161.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.16 via Frontend Transport; Mon, 1 Jan 2024 22:24:32 +0000
Received: from DM4PR15MB5379.namprd15.prod.outlook.com (2603:10b6:8:62::5) by PH7PR15MB5125.namprd15.prod.outlook.com (2603:10b6:510:139::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.24; Mon, 1 Jan 2024 22:24:27 +0000
Received: from DM4PR15MB5379.namprd15.prod.outlook.com ([fe80::f0a9:9022:88bf:c525]) by DM4PR15MB5379.namprd15.prod.outlook.com ([fe80::f0a9:9022:88bf:c525%4]) with mapi id 15.20.7135.023; Mon, 1 Jan 2024 22:24:27 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass; b=bOZB40bkG6xop6u58dwEAh7paRWKpO/dWV+cqlK24QEG1kHwCi0OH8eudrKBSrvunB9G/sDHftQptglhqkD0Duswuq6nH+MNysUCKWoL4xo33NfjgtiJ3YXm0YAg8piN3LCXvGWX3oG1F/m1qCCjeyCjHRvBSeO2sLVqhZclAkE8yA5Y9iy0yKb1pNwUZ9iedw38d5aRhRY81EiCPQxYZWj1PYSeYa84Oxgd8lk9y+X4gey7+tBojgfLOuXJqvnb2ru0lB/JwSlo3Z40RxdOgPdyUQ+iy55Vvsyyox17PAhay6JjwueabKvIgU/UOo0dC7H5YV+0Hc1IlHYnvqdAzA==
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cRq2vuohZ6oTxUYP2uQy18P5/Nv/XQtGvILti39lWkxpBGm2nOVOZORbhCHz6jQC1nRQkvFBpba2CCe3l4Fk3T2lIfd2FbUANfB10rcHisqGMqc3V4VH/4tyzB99+jjKJclo/L+DfCyfED8l3mDgYnnAoolmIgRHmU9dwVbTIRyih8cLw+BP7RrQ5NTV+knGsxSu2l2IOntSkKYqdBq8Nv5MhderNXQ6h3mJqFBPQeyfGfVkgrnr5OyoiQ7TDWi/zIx6lSAGHb7PKx/imk94wFuUZRmVoJV5EVXZ6Zfl/2hg2GG08vrpkOJ2vy8wMoKBIZCxZbQPx7u2UyVpls5tqg==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BYtadR4itnxYh0hJGsJFbSL9XzsZtedtrSfHHFnFXn4=; b=itz8B72ei1sMMayv1l5e832l8w32a7ndVH+0uluIW5BoNSrDwfEwtd4IwAvq041egwl1atyCxnP1ItgnR9uCUEJJOi57G/425FyUumsXv9mFtRlNUqesptmjsInN8v/DsI4PQ94OFzhvAJjZYMiSS6sbNwzQT/lfLMyPEV8b/xXfzKrMlLFkD6hFlHXGtTvkYe/df/IjLojm6yYAFdyxGBi6S613eAql3XHQVW/gUCEqHGxWKX7vBpUhkBB8OBmzXzlTKIq+9TzEs8fKXE/wgTl/dUC6s3zC6SLAIW+IgxLE8HaEfQ8Rn7BEpfyb8KAe0YE+19W1TLI7DX5uKjMF0A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BYtadR4itnxYh0hJGsJFbSL9XzsZtedtrSfHHFnFXn4=; b=NnTJfj6GjC/aYS1xl3fEPJObf5KCoVi5GRs/E9hE+TMGumT8In2U5bwYpjRq618vo7Evx9KRkwAZap6X2LnMhsONNpJRGBffmibMPitCZFmMeXjQu1hy6Z36EVfxz4EMB2g8UUjDdy8mnc+wwt/kGRp2F9Wd9CSr0YFMW0u+HHB168AKrr9aLjlkOHHDRC+JcwOVgXsoThx1ibG516BQVD7/Omlx2GToj4ar6/jvULwNbUQKbskly9ej4tHskqU048ASXTiVikJR1sCzdtLtsCTS1fDGPpVkcY5PZNyiMhdJ6iG+6W64g9XuDb4uR4bYUj3k/xBy6rmUl1y7Y8aN9A==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is 40.107.243.76) smtp.rcpttodomain=dow.com smtp.mailfrom=techtalksummits-tts7.com; dmarc=bestguesspass action=none header.from=techtalksummits-tts7.com; dkim=none (message not signed); arc=pass (0 oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=techtalksummits-tts7.com] dkim=[1,1,header.d=techtalksummits-tts7.com] dmarc=[1,1,header.from=techtalksummits-tts7.com])
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=techtalksummits-tts7.com; dmarc=pass action=none header.from=techtalksummits-tts7.com; dkim=pass header.d=techtalksummits-tts7.com; arc=none
Authentication-Results: spf=pass (sender IP is 40.107.243.76) smtp.mailfrom=techtalksummits-tts7.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=techtalksummits-tts7.com;compauth=pass reason=109
Received-SPF: Pass (protection.outlook.com: domain of techtalksummits-tts7.com designates 40.107.243.76 as permitted sender) receiver=protection.outlook.com; client-ip=40.107.243.76; helo=NAM12-DM6-obe.outbound.protection.outlook.com; pr=C
From: "Mike Healy" <email address removed for privacy reasons>
To: "email address removed for privacy reasons" <email address removed for privacy reasons>, "email address removed for privacy reasons" <email address removed for privacy reasons>, "email address removed for privacy reasons" <email address removed for privacy reasons>
Subject: TechTalk Tuesday Virtual
Thread-Topic: TechTalk Tuesday Virtual
Thread-Index: Ado9ASCZqQPKy0cHQQ6idUFC0Im9LgAAAY6A
Date: Mon, 1 Jan 2024 22:24:27 +0000
Message-ID: <email address removed for privacy reasons>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
Authentication-Results-Original: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=techtalksummits-tts7.com;
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-calendar-series-instance-id: BAAAAIIA4AB0xbcQGoLgCAAAAAAgphvczjzaAQAAAAAAAAAAEAAAACXOP2HC6UdHkX581vTnF0k=
x-ms-traffictypediagnostic: DM4PR15MB5379:EE_MeetingMessage|PH7PR15MB5125:EE_MeetingMessage|BN8NAM04FT022:EE_|BL1P164MB0108:EE_|SJ0P164MB0100:EE_
X-MS-Office365-Filtering-Correlation-Id: 6f23e63e-1d5e-45c4-dc6f-08dc0b186dd7
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: VPPUn2ZvTYJtvW+v1xWxJCHGT4x70tVGIZPVhIvKIq2Fftowa+eFBpVfKcwTOCv9yIrOeYh7/6/YGuW83l1q18mZZPrg+UguR+XtD1Vx49Zqfe/5P4VuIzZoyxFbVlIjgSNhrVqBxEIChzdYzx1vrsm53498xQAQTt+WCmbSS7TlFuFVz5t+0Ird1nXnJm85OwQ18gM9dnRUh8FJZvmX/jgMK7jrl715i7O52Pse3X8gsQFRbEo5GWjPXvXunMpw4rZ9J04KwrgaZQsz6StYIKlPjIPFHWm/k8H46SsMV+y8gN0IhOApqGiUq0PMbwAgdLT+IHxYOrFWvfpVvgXNKBLk4FTN1OL8v64J8p22QUoIYhE4hxNkMnUuyaCA+hqzMurfIH8LfRA04KXASkIArbprjWkRMUWdE4x+3M4F17dyfJdAAz0UPjfLtnNWTz8qs/bzDrdSo7p/bK556oOHr3gqJ045TF8k1SVBiPQfqBGn7YQV4RWBrE4uah03NXGDQBOIaGAGjdM+1O3i2Uhwu6Szm/LPVXTDMk5xrJv+fuaYIdgoi/y0bIpxXLKhT7n4Jn5Pl7r+zJYCdCoEyxi2OMui97z6iGmifEc5lgJ7y46Bti1KdFK+bR5H8ZMrEFfZX9mC0R1CDckgpxq5vHjxQ3bF7RzNTIGeivYq0ndPjUw=
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM4PR15MB5379.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(396003)(376002)(346002)(39830400003)(136003)(366004)(230922051799003)(230473577357003)(230373577357003)(451199024)(1800799012)(186009)(64100799003)(83380400001)(71200400001)(7696005)(6506007)(9686003)(3480700007)(5660300002)(7406005)(7336002)(7416002)(7276002)(7366002)(7116003)(52536014)(76576003)(41300700001)(2906002)(90282003)(478600001)(88732003)(89122003)(122000001)(966005)(316002)(66946007)(76116006)(8676002)(8936002)(64756008)(66446008)(66476007)(66556008)(110136005)(86362001)(99936003)(38100700002)(33656002)(166002)(38070700009)(55016003)(66899024)(1406899027)(282314004);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-Original-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-Original-0: obA7yRj3aAPsxGHAjISGhN9tYdPzoM0h9X9gPIoHi3hh+qi3namOJaR+KW97P8+2p9d7itbcDprjA4geG/mU6vv0AI/c6IEKlsrq+95MHJZp7MhlyEMuajm67+9+B3O3rERTSLguCF1Cgt/6NyLEnuPOFkTr7mVinQ06or1qNg56K5TZgkzIod6YWA2xs6BCrUryegKYs3sY4CY7VHlNDAukULC0Fe9v6Gg9dPxglFvlkMwiicgAkFTkWzqfTkk1VNOREGCfeT83XfFNG6xwhrMbbPlO4ILve1IGpNMlQ+8ACf8pRblMF5d9iHRZitMZoaspDFTVMyvItlVmYti6ALo2uGiHd0BdikDo+QaXlcBaYw/IZQl5tI6fzNjPesBtk6aVhCg3B3yleqhah6UysQX1p7zL09ll2xmaHYblSKi1pc/pYVFz8IbUfFYr6SaCcvLt6i8+SAl9yfEyNAwavdJL58y/WSNAnjr2duo96LT9RbqOjRnlAClBPpcVc4osgHWZsjWumGGN7dPLPWzrZPUDp7iC/R/CORpUihPbu19WsYa56PMz7QF7sKfdqLR22m0KZw5Xqg3Ifro/MnszgYJgfjrH5xFKasO8r136OGGl6CyDMpKyZdQhhEOxvCOsXCIgesvrKfeQjFGbzgcTkBdYnoIOMjY7QgPLA0XV16NtWhzNUP5+0J/ys9ZwLvqdDOnoFV2AyEYmz1ymCJFL6RMb5XEfEpenvuL08TFwodoPOUho5GxxqhC5T9PqtmIWEovfwarTUrIKszgxtpwmB19COl+j/pwUdaiP/hcCUrLb9RTz5N34CxeKDPWqUtnp0jjq/kH/ej+5nmo1pk/x3qKo7+oOf3BfS/UzOjj/n2DJ2hjrTdHl+d3UO9mcnkD2uanz0KTCsaOseFixfQS6wa1TQ5ER5Nq8vRvQRqYREH9dL2u01N8Su23T5IVr8tt+0A0D2zRcGl3CGEw0FXs7qe/dM+NDZY7u+TQUS5yEMu0pEeGPTMLhwyyID36RP4mynhEkllRTQ9V8fedG1R5W4li7nDqvW4bLw4YmVHUDKRlHeldxi/lTSZvGzkIy9aA7eAV5O8hs8H6L+SySHetj+8N/WYQG9CpJNe820vyiLyOZk7sKMRdecLLkZoBzqdHs6WriKqRLsM12M9YPKZ2QZ0hp/bnhbA17hiMAb1KYzrXWxnyIJI3RNtqZK/xH7SYSM8UVmgzrpKpQZT3Q/GE0kQ12HjyuYTu42YJWLOvxj45UngOJBw99ttZsq2hCZb3lCC4j8P8gDlxUw1M309hCRAa/pJVNPJpREpSv5oOkwc+PlPa4NAhpbYx4EFpJYIiDKoAnX2uC9FcFfabmNwldTGDb21nemcfAJ5CcYjaLOdECtkJzHJzNY2sftd74Ecrvkpy2rq5R1fpvvdEuNnylM0VPQ0O7xQJusYCedrnNMvpW/6BAwx0z7dhufmCG4A4Nn663aeAYw4r/YqW4En/bQc6fWZAP7mepHi2JX0Zg7ZScFmjTy82QR+emYLUNh7ddysjg7wvbKyOpna5UOudntDa14AKkoAcpOvRDWcp9OCOVtmaevrGbo2pd75fhrwMETnBzhYqavnkij/ZZCor/SSF7jDL/7wa7JZXEZDFjrRSyRw7ZAY9wEpCbDf/xeZeoby802XWHYuXp/mbUopTWBA==
Content-Type: multipart/related
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR15MB5125
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1P164MB0108
Return-Path: email address removed for privacy reasons
X-MS-Exchange-Organization-ExpirationStartTime: 01 Jan 2024 22:24:32.9751 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id: 6f23e63e-1d5e-45c4-dc6f-08dc0b186dd7
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: c3e32f53-cb7f-4809-968d-1cc4ccc785fe:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped: BN8NAM04FT022.eop-NAM04.prod.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted: BN8NAM04FT022.eop-NAM04.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Exchange-Organization-AuthSource: BN8NAM04FT022.eop-NAM04.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs: c876c106-c329-4eab-9d36-08dc0b186a77
X-MS-Exchange-AtpMessageProperties: SA|SL
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Antispam: BCL:5;
X-Forefront-Antispam-Report: CIP:40.107.243.76;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:NAM12-DM6-obe.outbound.protection.outlook.com;PTR:mail-dm6nam12on2076.outbound.protection.outlook.com;CAT:NONE;SFS:(13230031)(4636009)(286005)(230373577357003)(230473577357003)(230173577357003)(230273577357003)(451199024)(6302899012)(82960400001)(166002)(3480700007)(66899024)(7636003)(356005)(55016003)(86362001)(6506007)(9686003)(7696005)(33964004)(336012)(83300400002)(83320400002)(83310400002)(83380400001)(966005)(58800400005)(45080400002)(34756004)(7116003)(52536014)(22186003)(4650499012)(26005)(83280400002)(83290400002)(8636004)(110136005)(8676002)(1096003)(33656002)(1406899027)(282314004);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jan 2024 22:24:32.7876 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 6f23e63e-1d5e-45c4-dc6f-08dc0b186dd7
X-MS-Exchange-CrossTenant-Id: c3e32f53-cb7f-4809-968d-1cc4ccc785fe
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM04FT022.eop-NAM04.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-EndToEndLatency: 00:00:19.6821076
X-MS-Exchange-Processed-By-BccFoldering: 15.20.7135.011
X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420123);
X-Microsoft-Antispam-Message-Info: 7AgYoRm7KA2kk0lb4ReZT6ub9/8InW3si9s8jfI6An78NTixzkTy7xMROmye0PTt1IrFR2WEJB7NnHcAaDrFU8EukB/tERtPjqqlDSpF4gNjBfsWOw6kfYqbL5/3PsgcqRNWgQ49/s1ZYv0k7Dl59Dn0tTnWj+TlfG4FWcJ6bECqSSPnul7558DmgVt3lS5i/wBq2n2JUjXnSt8C+bicaeg2Ww5Mj6tG/n5NJYHww5CNEud4tM+zNNq4qlETWqNuXdlVwJdbb4zXOGMxkoY87thviVrm7tCDNivKCIz6oHbXZ7W+mmSQZkJ0+vCrnP8ePRPs3XM97Xf2+A+Mo4py/RjbAq6Rgs0QpTcpgbuGUFGrOtyfNl1haVeN9y60lmUrHtW/Hr4CjXn+7xo5azt8Nk/LJXfYXANovYgC4vStCEDBN/OHUAOw12gIXIdIoQkKGRxkRYz1mVC8NX3DtxEud06RnvYwM1aJe4P9BJU8rlXGLTN5ZRfU7AXki+n0tyLv+tG8GJNDhba79caNdznqQiQPr0q+J47qKp0ni2viWoYW65YAsoAmr6LxmImXrGlPBTRFGHC5ZJ5NJ0DyGsmxUbDdEiN6gyoEq2aTMS+Zfp0PO1nC4oSV+2W2v+lAMeL9TEIXkDjz8xq/znYgfEp6r5+gPFNwYnPjj7MpF+lnS3Ykt15EaorUguBfH6CHAU2zn2EkJZZDnRPK/Zk6+POur4N4srYx54A1s7w+qExOyi0+hEF+wvMvW8xAQzbEx9OLjqtW6CY3HzCHQv6vI7/c9gIw13FDrTiGMLKnXbbZZ9bw300RIwdyGnzZYnbmJ3lpFmNScLBOs+YyqxaYsOlBYM1dx/sDIHrQLAWneTG+/y0Q8dxssGPMkEEJ/bZGp9Z0mwWjWXuAdpQGyLGoUxRYRqlJo0VsKcnImcVXnx5UhErAlPmMFTAWnMd/yre6k4HulnxyVFaO/FOTL9mYZ96NFrBnD4h+qu9/u8YYtKVYHpQEC6mycjXigwWUauulBWp09j3fDq1fcl5iIDryC2DsxjmFRrqog9Nm+DhMny4e6X4DCaXSQ69sTqRIdB0cAaUGQcCPHT8HWIQUki8G9whTIIcSpzmomP3q3dB9ZdFqSBZUUBU+rh0FSdmJyuIwNykIrZFB06op+5eMSocTBR/hoIvv/Yie6tKXfZZZLnQwgVKZ/d/dVi4ODw5aebIGWH9DFF++PsJ/6qAwSi27bYeHSmN24hABgNFQX+hVEpJc0zpuoYJf/3gkuLMYyUI/Pr9GWPjxGDh52qIry/xgF2BBuJUpft/fEFzKinCvi6XbllMI/ViauRZRHR6fH/6ZSlH/XRZ1ZUxZSyPPTzHu6yqtXq0442aBTS2xIz9MKYsY+l+tPCyyWkwXzMrUfeOVdCOBYkLT8EuWJZUSMMOBOVgc/Tx93aknpNJUunNvcgd/Ut4ATphLSl4+bSk4ud19/ZYckxY+GQpMGwkpa1/AydQpr8ef1gxO80qpWpg71u5ikTYlcIivEkH6j4jdVh1g/tvLPzE5yjTEmnhEbLiLvtZ/zXm34sWzjzZsKRYaomBCuAY8xP0R1XJpBAbYR9DN1/gwALcuS+7aLturFGbjrdY9J3m3lPoAvwcgWfFQVir8BaHjTUkaKJS6nYk+9mNqSNh2P4laSu/SxaVyx59E1TEbKgp2rpv/sJfP6+PVhKevjgeMmwg/xTQwiDkPvZwxvzipPczaDd4GBFbrD4paM4tcEzum09O8OazsXG+1D+PUAoqV1Qlp3hU0gv52b6TJe5p4qtdiCctJ6TvV+3LFfLk/vM2Ej81TTyrBQ//+pBmnaZF4PgkQOnStGyTD7BQD6Cq6RDlIIotS/pA0lUJdY7xyjtfmFxPIi8W5xKMI4NxW6FwSVXL+XfKAqApsrTcDraitEShtL5XWB8Igb2wQBG/Y8OmUU57K+Wn+gc4eu9edV8dWVe6V5ltU5nMez5RstRE2EbecbvFlWaSqsw4b4KZtlKls2EH1vmRndlIPWSknYWQ=

 

 

One particular header I'd like more information about is x-ms-exchange-senderadcheck. Does anyone know what this header does? I'm wondering if I can key off that somehow. 

 

1 Reply

Possibly take action if message is from outside the organisation and x-ms-exchange-messagesentrepresentingtype header matches 1 or 2?

 

Definitely try that with a non-intrusive action to begin with. Outlook meeting objects are slippery critters at the best of times, and my suggested directionality test might be no good. If so, possibly you could restate the predicate if your list of accepted domains or hybrid arrangements are not too complex?