Avanan - Overriding Microsoft High-Confidence Phish False Positives

Description

Administrators can select to automatically release emails from the Microsoft quarantine if Avanan classifies them as clean. With the introduction of Microsoft’s Secure by Default approach, emails found by Microsoft as High-Confidence Phishing are quarantined regardless of other selected Microsoft workflows.

Requirements

Admin access to the customer's Avanan portal.

The Process

Avanan already integrates with the Microsoft quarantine and inspects every Microsoft-quarantined email.
It can now be configured to automatically release emails quarantined by Microsoft for being High-Confidence Phishing emails, if Avanan classified them as clean.
Administrators can also select to restore those emails if Avanan classified them as Spam or Suspected Phishing.

To do that go to

Security Settings > User Interaction > Quarantine > Emails Quarantined by Microsoft >  Emails Quarantined by Microsoft as High-Confidence Phishing, check the Automatically restore… box and select your preferred Avanan verdicts.

Emails automatically restored by Avanan will be marked as such in the Email Profile page: