O365 filtering out SPAM before it gets to Sophos

Question

Since moving from another antispam provider to Sophos, I've started getting Microsoft Quarantine emails again. I've done a message trace and it clearly shows that the message was sent to Sophos, however Central has no record of that email ever arriving. However, if I go to Microsoft Quarantine and release the email, Sophos then blocks it and it shows up in Central as having been blocked for being SPAM. 
 
 I would have thought the prefilter rule and redirection would catch a message straight away. I've done all the domain and mailflow verifications in Central and they've all come back saying everything is correct. 
 
 What's going on and why is Microsoft suddenly collecting SPAM? 
 
 For any Sophos staff who happen to be watching, case 06513956 has been going on for almost a week and getting nowhere, despite 2 hours on the phone today.

emmosophos · Accepted Answer

Hello, 
 The Following KB has been published related to this issue. 
 Regards,

Tom Foucha · Answer

Secure by Default is something that Microsoft implemented that cannot be bypassed. The Pre-Filter rule turn the Spam Confidence Level score (SCL) to -1 which tells M365 not to inspect for spam. We are in discussions with Microsoft Product Team about this topic among others. Do you see the SCL -1 in the headers of the messages? The Pre-Filter should be the first rule in the list of rules.

Tom Foucha · Answer

Thanks, one last section to inspect, keeping in mind that Sophos is in talks with Microsoft we are dependent on their service no matter whether it is gateway mode or MFR. Now what is said that if the MX does not point to Microsoft that you can disable some things in Secure by Default: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/secure-by-default?view=o365-worldwide 
 "Third-party filters: Secure by default only applies when the MX record for your domain is set to Exchange Online Protection (contoso.mail.protection.outlook.com). If it's set to another service or device, it's possible to override" 
 It does become a trade off at this time between having the MX pointed to Sophos or M365. Even in my configurations I still end up with HCP (high confidence phish and a splattering of spam) ending up in the Microsoft Quarantine. 
 Policies > Rules > Anti-Spam policies - inspect each policy and edit to turn off anything you can

O365 filtering out SPAM before it gets to Sophos

Top Replies