Sophos Email customers using IP-based mailflow rule connectors must migrate to certificate-based configuration by March 31st. To see if you're affected Click Here.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 15 replies
  • Answers 4 answers
  • Subscribers 21 subscribers
  • Views 18152 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Phishing Campaign emails being sent to MS Defender quarantine

Slappy

I'm I the only customer using this Phishing Campaign.....

I been trying to configure this thing so we can use it.  However, even after configuring per the documentation.  The campaign email are still being caught be Microsoft's Defender and quarantining the emails.

Documentation indicates that I only need to whitelist 2 IP addresses but when looking at the message in quarantine, the message has senders IP that is not matching the two I was told to whitelist.......

I would have thought this to be an easy fix for support, but now on week 2 with several remote sessions and circling back to the beginning......

Open Case# 07016835

Somebody...anybody who has dealt with this please help me.......



This thread was automatically locked due to age.
Parents
  • 0

    We are trying to use Sophos Phish Threat too and I am in the same situation, received an email to say I have been enrolled into training for reading the email which I never received. Checked sophos and its showing as delivered, checked Defender and its showing quarantined for safe attachments policy. So everyone kind of knows what emails to look out for now, kind of pointless! 

  • +1 in reply to Adam Preshous

    We are working on a method called Direct Delivery which will use the Microsoft Graph API to place Phish Threat messages directly into the end users mailbox bypassing smtp and inspections for M365 customers. This will be delivered early 2024 is our plan at this time. 

  • 0 in reply to Tom Foucha

    Hi Tom, what is the deployment process for Direct Delivery looking like at the moment? We as an MSP are trying to assess if it is more efficient to complete the usual phish threat setup (which as long as it's configured right at the start, we don't run into any issues with EOP blocking), or if the new Direct Delivery feature if it's easier. Cheers

  • 0 in reply to Jett Potter

    We are on target for a Q1CY2024 release. It will require additional authorization in M365 so it will guide you through logging into M365 and approving the additional auth. The new Direct Delivery feature will be much simpler in that you will no longer have to create the Phishing exceptions in M365 or add to Allow Lists in M365 etc. Since we won't be sending the messages via smtp but via the Graph API. For new customers this will be the preferred way, I expect partners and MSP to take their time migrating and clean up old rules, as long as it is working as you say.

Reply
  • 0 in reply to Jett Potter

    We are on target for a Q1CY2024 release. It will require additional authorization in M365 so it will guide you through logging into M365 and approving the additional auth. The new Direct Delivery feature will be much simpler in that you will no longer have to create the Phishing exceptions in M365 or add to Allow Lists in M365 etc. Since we won't be sending the messages via smtp but via the Graph API. For new customers this will be the preferred way, I expect partners and MSP to take their time migrating and clean up old rules, as long as it is working as you say.

Children
No Data
Unfiltered HTML