LordChappers

Hi @Koldov, I appreciate the reply. I've now found the culprit after looking into the headers - our email filter (Checkpoint) has been intercepting the messages, but passing them through from their IP where they then got trapped. I've added the Sophos IPs to the Checkpoint exclusion rule and it is now working. Many thanks for the help!

Hi Free, Thanks for the reply. We don't have licences for Defender so can't use Investigations, Explorer, Campaigns, Threat Tracker, etc. We do however have Sophos Phish Threat, and have been using it monthly for a while, but every couple of months Microsoft change something that makes the emails get quarantined (I'm doing a copy of the same campaign I did in September & October, with the same dummy sender address and it's suddenly not working). I have removed all of the whitelisted addresses and IPs (including the connection filter IPs as @Koldov mentioned above) that I had set up previously and have the following in my Advanced Delivery rule, but it is still quarantining my test emails: Any help would be greatly appreciated! This situation is particularly annoying as we do the phishing tests to show that IT Support are constantly doing work, which prevents me from doing proper work, but when doing these tests (that should take minutes) I spend ages troubleshooting!

Good afternoon guys, This thread has been really interesting - It seems as though every time I've done a phishing test (we do it monthly to random users) it will instantly get quarantined until I botch my way around whitelisting the address. I've now removed all of the whitelisted domains/IPs from the anti spam policies and added the Advanced Delivery settings you've advised (with some of the additional Sophos simulated URLs) but I'm still getting quarantined. Did you end up amending the 'High Confidence Phish' setting? I'm glad Defender is doing it's job, but this is maddening!