Message trace shows Advanced threat Protection - Blocked and redirected

%3CLINGO-SUB%20id%3D%22lingo-sub-1227450%22%20slang%3D%22en-US%22%3EMessage%20trace%20shows%20Advanced%20threat%20Protection%20-%20Blocked%20and%20redirected%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1227450%22%20slang%3D%22en-US%22%3E%3CP%3EOne%20of%20our%20users%20said%20that%20they%20have%20not%20received%20an%20email%20and%20when%20we%20did%20a%20message%20trace%20it%20says%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%22%3CSPAN%3EBlocked%20and%20Redirected.%20Advanced%20Threat%20Protection%20Malware%3A%20Verdict%3A%20Infected%2C%20Action%3A%20Blocked%20and%20Redirected%22%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EHowever%20Message%20trace%20status%20shows%20that%20the%20mail%20is%20delivered..%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EMy%20question%20is%20if%20the%20mail%20is%20delivered%20then%20why%20are%20we%20getting%20the%20above%20message%20-%20blocked%20and%20redirected.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1227450%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
Frequent Contributor

One of our users said that they have not received an email and when we did a message trace it says 

 

"Blocked and Redirected. Advanced Threat Protection Malware: Verdict: Infected, Action: Blocked and Redirected"

 

However Message trace status shows that the mail is delivered..

 

My question is if the mail is delivered then why are we getting the above message - blocked and redirected.