none
ATP scanning links prior to arrival? RRS feed

  • Question

  • Our organization implements ATP safe links. Over the last couple of days, we've had links inspected prior to arriving in a user's inbox. According to the following ATP Safelink article (https://support.office.com/en-us/article/office-365-atp-safe-links-dd6a1fef-ec4a-4cf4-a25a-bb591c5811e3), ATP doesn't scan a URL until a user interacts with the email and clicks on the URL. 

    After a reviewing logs, I get the following IPs: 40.107.235.67 & 23.103.149.154. The IPs are registered to Microsoft so my guess it's the IP to the VM that's inspecting the link. 

    Has the process for ATP changed so that they now inspect links prior to arriving in an inbox? If not, any idea as to why links are being inspecred prior to arrving in an inbox? Still investigating the issue and reaching out to determine if ATP is the cause.

       

     
    Thursday, June 14, 2018 5:33 PM

Answers

  • Your post is not a solution. I had the IP information listed in my post prior to you sending the link. After submitting a ticket, Microsoft confirms that ATP is inconsistent and may scan links prior to arrival in a user's inbox, which is the exact oppostie of the behavior it's intended to do.


    Kyle Harward

    • Marked as answer by Kyle1233 Monday, June 25, 2018 4:01 PM
    Monday, June 25, 2018 4:01 PM

All replies

  • I'm pretty sure they do both - scan the link upon arrival, then rescan upon click.
    Friday, June 15, 2018 6:23 AM
  • Hi Kyle,

    Per my knowledge, the process for ATP does not change. These IPs would be the Microsoft data center IP addresses are used by Microsoft Exchange Online Protection (EOP). Details see:

    Exchange Online Protection IP addresses


    Best Regards,
    Niko Cheng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Friday, June 15, 2018 6:24 AM
    Moderator
  • Thanks for the link to IPs. Your reply and the preivous one contradict each other. I'm still troubleshooting the cause.

    Kyle

    Friday, June 15, 2018 3:06 PM
  • Your post is not a solution. I had the IP information listed in my post prior to you sending the link. After submitting a ticket, Microsoft confirms that ATP is inconsistent and may scan links prior to arrival in a user's inbox, which is the exact oppostie of the behavior it's intended to do.


    Kyle Harward

    • Marked as answer by Kyle1233 Monday, June 25, 2018 4:01 PM
    Monday, June 25, 2018 4:01 PM