Stop test phishing emails being quarantined

[kennysarmy]

Just signed up for the 30 day trial of Sophos Threat management.

 

Emails sent out are being quarantined by our Office 365 settings.

 

In my Anti-spam settings I've added in the 30 domains they use to send out their attack emails.

 

In Connection filter policy ‎I've added in the two IP addresses documented by Sophos.

 

But there must be something else to do to stop the emails being quarantined!

 

 

 

Should I change the option underlined in red?

[FN-GM]

You might want to do this via a mail flow rule

 

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/use-mail-flow-rules-to-set-the-spam-confidence-level-scl-in-messages?view=o365-worldwide

 

You might also want to add the attached into the rule to force it into the Focused inbox.

[ZeroHour]

Check out the headers using:

https://mha.azurewebsites.net/

(or install https://appsource.microsoft.com/en-us/product/office/WA104005406 )

 

It may help give some clues. I am not familiar with Sophos Threat Management to know how they send the emails and how they appear sadly but that tool is what I use to help diagnose.