| Description |
This article describes how to avoid emails being deleted once they are released from quarantine. |
| Scope | FortiMail v6.2.x, v6.4.x, v7.0.x, v7.2.x, v7.4.x, v7.6.x. |
| Solution |
The end user typically receives a quarantine report: 
As soon as the email is released through a web action, the email is deleted. The log will show the email has been released, followed by the web delete.
This is caused by the ATP/Defender for Office, where a second rule must be included for incoming mail to include a second header with the value below:
'X-MS-Exchange-Organization-SkipSafeLinksProcessing' - set the value to '1'.
Once this is done, the deletion should not be performed from the Office 365 ATP end. |
