In case you are using Microsoft O365 Advanced Threat within your mail environment, there is a possibility that you might experience false clicks and email attachment opens. In order for ThreatCop’s email to function properly, additional rules to bypass Microsoft’s ATP are required.

ATP Link Bypass Rule :

To set up a mail flow rule to bypass ATP link processing :

STEP 1: Create a new mail flow rule in your Exchange/Office Admin center. 

Step 2 - Click on Add a rule  

Step 3 -  Now a dropdown will open up and click on Create  a new rule.  

Step 4 - Here you will redirect to a new modal box where you are required to enter the below details : 

• Give the rule a name such as "Bypass ATP Links" as shown in the above screenshot.
  

• Click More options....

• From the Apply this rule if…. drop-down menu, select The senders then select IP address is in any of these ranges or exactly matches. 

• Enter our IP address. You can check for the list of IP addresses in this article here 

• From the Do the following… drop-down menu, select Modify the message properties... and then set a message header.

• Click the first *Enter text... link and set the message header to:

• X-MS-Exchange-Organization-SkipSafeLinksProcessing
  

• Click the second *Enter text... link and set the value to:

• 1

• Click Save.

ATP Attachment Bypass Rule

Below are the steps to set up a mail flow rule to bypass ATP Attachment Processing:

1. Create a new mail flow rule in your Exchange/Office Admin center.

2. Give the rule a name such as Bypass ATP Attachments.

3. Click more options.

4. From the Apply this rule if… drop-down, select The senders then select IP address is in any of these ranges or exactly matches. 

5. Enter our IP addresses. 

6. From the Do the following… drop-down, select Modify the message properties... and then set a message header.

1. Click the first *Enter text... link and set the message header to:

• X-MS-Exchange-Organization-SkipSafeAttachmentProcessing

2. Click the second *Enter text... link and set the value to:

• 1

7. Click Save.

ATP Link Bypass Rule by Header :

Following are the steps set a mail flow rule to bypass the ATP link processing by header:

1. Create a new mail flow rule in your Exchange/Office Admin center.

2. Give the rule a name such as “Bypass ATP Links”.

3. Click more options.

4. From the Apply this rule if… drop-down, select a message header then select include any of these words.

5. On the right side of the screen you will notice *Enter Text… and Enter words…

6. Click on *Enter Text… which will open the specify header name window. Type the header name in this window.

7. Click on *Enter Words…, type Kratikal and click on the +sign

8. From the Do the following… drop-down, select Modify the message properties... and then set a message header.

1. Click the first *Enter text... link and set the message header to:

1. X-MS-Exchange-Organization-SkipSafeAttachmentProcessing

2. Click the second *Enter text... link and set the value to:

1. 1

9. Click Save.

ATP Attachment Bypass Rule by Header :

1. Create a new mail flow rule in your Exchange/Office Admin center.

2. Give the rule a name such as “Bypass ATP Links”.

3. Click more options.

4. From the Apply this rule if… drop-down, select a message header then select include any of these words.

5. On the right side of the screen you will notice *Enter Text… and Enter words…

6. Click on *Enter Text… which will open the specify header name window. Type the header name in this window.

7. Click on *Enter Words…, type the keyword that is to be found in the header and then click on the + sign.

8. From the Do the following… drop-down, select Modify the message properties... and then set a message header.

1. Click the first *Enter text... link and set the message header to:

1. X-MS-Exchange-Organization-SkipSafeAttachmentProcessing

2. Click the second *Enter text... link and set the value to:

1. 1

9. Click Save.