Overriding Microsoft High-Confidence Phish False Positives

Administrators can select to automatically release emails from the Microsoft quarantine if Check Point classifies them as clean.

For years, Harmony Email & Collaboration’s main task was to complement Microsoft’s security by finding the malicious emails Microsoft missed and quarantining them before they reached the end user mailbox.

Recently, with the introduction of Microsoft’s Secure by Default approach, emails found by Microsoft as High-Confidence Phishing are quarantined regardless of other selected Microsoft workflows.

While this approach is indeed more secure, false positives in High-Confidence Phishing detections make administrators spend a lot of time releasing them from quarantine.

Harmony Email & Collaboration already integrates with the Microsoft quarantine and inspects every Microsoft-quarantined email.
It can now be configured to automatically release emails quarantined by Microsoft for being High-Confidence Phishing emails, if Check Point classified them as clean.
Administrators can also select to restore those emails if Check Point classified them as Spam or Suspected Phishing.

To do that go to Security Settings > User Interaction > Quarantine > Emails Quarantined by Microsoft >  Emails Quarantined by Microsoft as High-Confidence Phishing, check the Automatically restore… box and select your preferred Check Point verdicts.

Emails automatically restored by Check Point will be marked as such in the Email Profile page:

Note – this feature is being deployed gradually. You should see it in your portal during the next 14 days.