locked
All scans to mail arrive in quarantine due to AntiPhishPolicy RRS feed

  • Question

  • Since 3 weeks, all scans to mail arrive in quarantine due to AntiPhishPolicy.  We need to release daily hundreds of scans manual from our quarantine.

    The scans are pdf files and Sharp printers add default a sentence with link to adobe.

    We have added the sender  address to the safe senders list in the AntiPhishPolicy, but this does not help.

    So on one hand we cannot remove the default sentence with link, as this seems to be hardcoded in Sharp printers.

    On the other hand the whitelisting in the microsoft policy does not work.

    Wednesday, January 22, 2020 8:26 AM

Answers

  • Hi,

    Found the solution with the help of a collegue.  

    The reason was that the reply address could be entered twice in the settings of the Sharp printer.  Due to that the system made the sender like this

    Sitescan@domain.com on behalf of Sitescan@ <domain.com Sitescan@domain.com> (Sitescan@domain.com  via domain.com) 

    and the AnitPhisPolicy interpreted this as impersonating. 

    Entering the same printername and return address on
    system settings/image send settings/scan settings
    and network settings / Quick Settings / Network name settings and SMTP settings

    avoided the change to on behalf in the sender address and made the problem go away.

    • Marked as answer by ITbrugge Thursday, January 23, 2020 4:18 PM
    Thursday, January 23, 2020 4:17 PM

All replies

  • Hi ,

    Welcome to our forum.

    >> all scans to mail arrive in quarantine due to AntiPhishPolicy
    This may be by design, AntiPhishPolicy identifies your email with pdf or link as spam and move them to quarantine.

    You may try contacting your organization admin to set your AntiPhishPolicy to a lower level if possible.
    For your reference: Set-AntiPhishPolicy.

    In addition, since here we mainly focus on general issues about Outlook desktop client, the advice we can provide is limited.

    Hope this can be helpful.

    Regards,

    Jeff Yang


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Thursday, January 23, 2020 6:00 AM
  • Hi,

    Found the solution with the help of a collegue.  

    The reason was that the reply address could be entered twice in the settings of the Sharp printer.  Due to that the system made the sender like this

    Sitescan@domain.com on behalf of Sitescan@ <domain.com Sitescan@domain.com> (Sitescan@domain.com  via domain.com) 

    and the AnitPhisPolicy interpreted this as impersonating. 

    Entering the same printername and return address on
    system settings/image send settings/scan settings
    and network settings / Quick Settings / Network name settings and SMTP settings

    avoided the change to on behalf in the sender address and made the problem go away.

    • Marked as answer by ITbrugge Thursday, January 23, 2020 4:18 PM
    Thursday, January 23, 2020 4:17 PM
  • Hi,

    I'm glad to see your issue has been fixed.

    Here I will provide a brief summary of this post for your information. This will make answer searching in the forum easier!

    Request/Expectation:

    All scans to mail arrive in quarantine due to AntiPhishPolicy

    Solution Summary:

    Entering the same printername and return address on :

    system settings/image send settings/scan settings

    and network settings / Quick Settings / Network name settings and SMTP settings


    Reference Links:

    No.


    Regards,

    Jeff Yang


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.






    Tuesday, March 3, 2020 8:56 AM