Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

internal user email quarantined and reason "high confidence phish"

Occasional Reader

Have you ever seen email quarantined when both sender and recipient are internal organization user and the quarantine reason is high confidence phish by the default built-in anti spam policy?

 

really confused why it happened and how to avoid such false positive..

2 Replies

@MSEKIRO I've seen this a few times lately.  I've been marking them as false-positives and this seems to be working-- at least for the ones I've reported.

 

Darren

YES, you could mark as false positives and I suggest checking the signature or anything else that may contain a link even an image.