Phish threat emails being deleted by Outlook

Question

Hello, Apologies if this is in the wrong forum. Outlook seems to be automatically deleting emails from Phish threat. 
 
 I've whitelisted the domains/IP's in Office 365, added the TXT records to our domain, added the proper whitelists in the mail flow rules in MS 365. 
 Emails are still getting quarantined by Microsoft. 
 After releasing them from Quarantine, they're landing in people's inboxes, staying there for about 5 seconds, and then being automatically wiped off the face of the earth by Outlook somehow (multiple users, even with no rules in place). This has been happening repeatedly for two months. Test messages come through without issue, but once I send out the actual campaign they're immediately flagged and deleted. 
 
 What am I missing and where do I start?

Raphael Alganes · Answer

Hello there, 
 Thanks for reaching out to Sophos Community and hope you are well. 
 The Phish Campaign Exceptions include domains of the associated phish threat campaign and the Delivery IP address of Sophos phish threat. Please follow and revisit the following KBs and retest to see if the problem re-occurs: 
 Phish Threat V2: Add IP addresses and domains in the allow list (sophos.com) - https://support.sophos.com/support/s/article/KB-000037983?language=en_US 
 Phish Threat V2: Bypass safe links and Safe Attachments Processing (sophos.com) - https://support.sophos.com/support/s/article/KB-000039921?language=en_US 
 ATP: Safe Attachments, Safe Links, and Anti-Phishing Policies or &ldquo;All the policies you can shake a stick at&rdquo; &ndash; Undocumented Features (undocumented-features.com) https://www.undocumented-features.com/2018/05/10/atp-safe-attachments-safe-links-and-anti-phishing-policies-or-all-the-policies-you-can-shake-a-stick-at/#Bypass_Safe_Links_Processing 
 ATP: Safe Attachments, Safe Links, and Anti-Phishing Policies or &ldquo;All the policies you can shake a stick at&rdquo; &ndash; Undocumented Features (undocumented-features.com) - https://www.undocumented-features.com/2018/05/10/atp-safe-attachments-safe-links-and-anti-phishing-policies-or-all-the-policies-you-can-shake-a-stick-at/#Bypass_Safe_Attachments_Processing 
 If the problem is still persists, I may recommend you to open a support ticket to have this further investigated and you may share with us the caseID so we can also follow along on our end. 
 Many thanks for your time and patience and thank you for choosing Sophos.