High Confidence Phishing – False Positives

You may be receiving a lot of requests from your customers regarding False Positives in the email filter. You may also be thinking to yourself “Self, it sure does seem like there have been a lot of False Positives Quarantined in my email lately!”.

For many MSPs, the next step is to go to your security provider asking all the “what, why, how questions,” ultimately asking the security provider to fix it. Well, the simple answer yes, we know this is happening. Unfortunately, we the security providers are not able fix it and Microsoft is wholly responsible for the issues that we are seeing!

Algorithm Shift

Every couple years, Microsoft tweaks its algorithms for detecting Phishing messages, and it seems to have occurred again with their recent announcement of the “Secure Future Initiative.” This has, in turn, created massive headaches for admins in the world, particularly when considering changes to the High Confidence Phishing Engine.

Many may recall that this is not the first time MS has created an administrative nightmare with these shenanigans. A few years back, Microsoft went to a “Secure by Default” Model and created similar issues with many admins flurrying to find a solution or work-around. At the time, Microsoft provided work arounds or solutions in the form of allow-lists or Exchange Mail Flow rules that would preempt the filter. It seems the difference this time is that MS has removed many of these solutions or work arounds and is beginning to force admins to go through MS support for the answer. Of course, MS Support has a stellar track record of making things extremely easy (tongue firmly planted in cheek).

30-Day Email Submission Review