Override Microsoft Enforcement

Sometimes Microsoft quarantines an email, or drops it in Junk, that Check Point considers clean. Override Microsoft Enforcement lets Check Point overrule Microsoft in those cases and deliver the message, cutting down on the false positives your users would otherwise have to chase.

What it does

When Check Point reaches a different verdict from Microsoft, this setting lets Check Point override Microsoft's decision to quarantine an email or send it to Junk, and deliver it to the mailbox instead.

Turn it on

Go to Security Settings → User Interaction → Quarantine and open the Override Microsoft Enforcement section.

• Select Override Microsoft quarantine/send to Junk if Check Point finds the email as clean, then click customize.
• Select Automatically restore emails quarantined by Microsoft.
• Choose which Microsoft classifications to restore: Malicious (all verdicts), Phishing, High confidence phishing, Bulk, Spam.
• Choose the Check Point verdicts that qualify: Clean, Spam, Suspected Phishing.
• Optionally select Move to Inbox for emails that Microsoft sends to Junk and Check Point classifies as Clean.
• Click Save and Apply.

Two things to know

Emails released this way are handled differently from normal quarantine:

• They do not appear in the quarantine digest or the End User Portal.
• The policy workflow does not apply to them. The original email is delivered straight to the user's mailbox.

Related

The end user quarantine digest