Troubleshooting Tip: Emails from personal quarantine are deleted upon being released by the end user when using Office 365 as a mail server

[gtreminio]

Description	This article describes how to avoid emails being deleted once they are released from quarantine.
Scope	FortiMail v6.2.x, v6.4.x, v7.0.x, v7.2.x, v7.4.x, v7.6.x.
Solution	The end user typically receives a quarantine report:   As soon as the email is released through a web action, the email is deleted. The log will show the email has been released, followed by the web delete.   This is caused by the ATP/Defender for Office, where a second rule must be included for incoming mail to include a second header with the value below: 'X-MS-Exchange-Organization-SkipSafeLinksProcessing' - set the value to '1'. Once this is done, the deletion should not be performed from the Office 365 ATP end.