What is Microsoft ATP?
Microsoft’s Advanced Threat Protection (ATP) provides additional protection from email-based malware attacks by evaluating links and attachments in emails and blocking them if deemed malicious. ATP uses the following strategies to protect your email:
- Safe Links: evaluates and confirms the validity of links in emails.
- Safe Attachments: scans and protects against harmful email attachments.
- Messages that are deemed unsafe by ATP standards will be redirected to your Junk folder.
What are Safe Links?
Safe Links evaluates every link in an email in real time to determine whether the link is safe. All links evaluated by Safe Links will be replaced by a longer URL that that begins with https://na01.safelinks.protection.outlook.com/? If you click on a malicious link in an email, a warning will be displayed instead of the actual website.
What are Safe Attachments?
In addition to the virus scanning, Safe Attachments analyzes every attachment to detect malicious content. If malicious content is found, it will result in:
- Attachment Removal: you will still be able to read the email, but the attachment will have been removed (see sample below).
- Quarantine: The email message will be removed and placed in quarantine for 30 days.
Why does a weird address appear when I mouse over a link from a trusted source?
Hovering your mouse over hidden links is always a good practice and can continue to serve you well even with ATP enabled. The Safe Links address indicates that it has been scanned for malicious content. Safe Links can be forwarded, as recipients will be able to access the content.
Can I opt out of ATP?
No - it is paramount that all University Office 365 emails are scanned and protected.
An attachment in my email indicates, “ATP Scan in Progress – Outlook Item” instead of the file I was expecting. Why?
As each message comes into Office 365, it is scanned for dangerous attachments. The message body can be read while that scan is in progress, but the attachments cannot because they aren't yet thought to be safe. While the attachment scan is ongoing–typically less than two minutes–you'll see a placeholder in the attachments area. Close then re-open the message to see if the scan is complete and the attachment is available. Note that even if you read the body of the email before the scan completed, following the scan, the message status will reset to unread.
I clicked on a link in my email and received the message, “This website has been classified as malicious.” Why?
If a link in your message points to a location that has been verified to be malicious in some way, Safe Links will stop you from accessing that location when you click on the link. If you think a site has been blocked by mistake, please report it to infosec@scranton.edu by forwarding the message as an attachment.
How does ATP impact my file storage?
ATP also provides protection against opening or downloading of files from SharePoint and OneDrive. When accessing a file from these locations, it will be scanned and if found to be malicious it will be blocked from opening or downloading. Although the blocked file is still listed in the document library and web, mobile, or desktop applications, the blocked file cannot be opened, copied, moved, or shared. People can, however, delete a blocked file.