Advisory: Sophos Endpoint - "Your connection isn't private." We're aware of a certificate issue and are actively working to resolve it. Please see: KB-000045954 for the latest updates.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos filtered Email to M365 - Microsoft then removing legit emails as High Confidence Phish

We have many clients on Sophos filtering of email before delivery to m365

Yesterday we had several clients, where the email was "removed" (after delivery) from their inboxes and taken back to M365 quarantine as a "high confidence phish"

Essentially it was very much (all) the emails that contained a URL

I'm wondering if the Sophos modification of those URL's at the spam/virus filter end (safe links) prior to delivery, is upsetting "something" at M365 and what do we need to do to fix it?




This thread was automatically locked due to age.
Parents Reply Children
  •  I have taken a look at the case but did not find any screenshots nor indicators as to what might be happening or causing this. I would like to set the expectation that this is not a Sophos issue but a Microsoft one. From the symptoms described, it looks like Microsoft did something in their product that basically classified emails that have URLs to be quarantined eventhough they were already inbox. As we did not create M365 our diagnosis/recommendations would not be on par with Microsoft's support on this matter. I would therefore recommend contacting them instead in order to resolve this faster.

  • Yes we have come to the same conclusion. 

  • Hi Dennis, did you happen to get to the bottom of this?

    I presume we could add our Sophos Central Email IPs and Domain / URL as a Third Party Phishing SImulation to bypass this, however I am struggling to find the URL to use.

  • Hi Chris
    We determined its a new Microsoft "feature"
    We Disabled the Zero-Hour auto purge  (ZAP) "feature" in the 365 backend
    (Given Sophos has already seen the email and considered it's safe)
    Problem has gone away now
    Not entirely comfortable with that solution, but its working for us