Internal sender is having his emails sent being delayed to internal recipient with error "Reason: 400 4.7.721 Advanced Threat Protection scanning in progress."

MOIZ ARSHAD 40 Reputation points
2024-06-21T16:52:06.62+00:00

sender ip addresses belong to one of these ranges: '75.xxx.xx.xx

set message header 'X-MS-Exchange-Organization-SkipSafeAttachmentProcessing' with the value '1'

I created that rule to bypass ATP. Long story short internal user sent an email with an excel file that was 97kb to internal recipient user. Sender stated that it took a few hours for email to be delivered. Is this the only way to bypass? only 1 user is being affected and his outlook is upto date and user is not offline.

Microsoft Exchange Online
0 comments
Accepted answer
  1. Bruce Jing-MSFT 2,070 Reputation points Microsoft Vendor
    2024-06-24T07:23:05.7766667+00:00

    Hi，@MOIZ ARSHAD

    Thanks for posting your question in the Microsoft Q&A forum.

    You created a rule to bypass ATP, but one user received a "400 4.7.721 Advanced Threat Protection scan in progress".

    From your description, we can know that the rules you created are effective for most users.

    Here are my suggestions:

    1. Check if the Safe Attachments policy is enabled in your organization and applied to specific recipients. Safe Attachments launches a unique hypervisor to open attachments. This can cause delivery delays for each message that is evaluated by Safe Attachments.
    2. You can add the user's domain name and IP address to the whitelist.
    3. You can try creating a rule so that emails sent to this user bypass EOP.

    User's image

    1. I found that someone has encountered this problem, you can refer to this URL: Delays when sending or receiving emails - Microsoft Community Hub
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest