check before: 2023-11-30
Product:
Defender, Exchange, Microsoft 365 Defender, Outlook
Platform:
Online, Web, World tenant
Status:
Change type:
Admin impact, Retirement, Updated message, User impact
Links:
Details:
Updated January 30, 2024: We have updated the content below for clarity. Thank you for your feedback.
Microsoft will stop honoring the mail flow rule which helps you track end user reporting. To improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently, we moved the submission service ahead of the exchange transport rule agent. Now the mail flow rules (or exchange transport rules) which you have for the following addresses – phish@office365.microsoft.com, junk@office365.microsoft.com, not_junk@office365.microsoft.com, phish@senpluspluseop.onmicrosoft.com, unjunk@senpluspluseop.onmicrosoft.com and junk@senpluspluseop.onmicrosoft.com won’t be honored as the agent won't be receiving signals for these addresses.
Moreover, the message tracking logs will show that reports going to phish@office365.microsoft.com, junk@office365.microsoft.com and not_junk@office365.microsoft.com as deleted or failed.
For example: [{LED=550 4.3.2 QUEUE.TransportAgent; message deleted by transport agent};{MSG=};{FQDN=};{IP=};{LRT=}]. Please ignore it as it is by design while we look for a better way to address it.
[When this will happen:]
We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by mid-February 2024 (previously late January).
Change Category:
XXXXXXX ...
Scope:
XXXXXXX ...
Release Phase:
Created:
2023-11-16
updated:
2024-01-31
the free basic plan is required to see all details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
changes*
Date | Property | old | new |
2024-01-31 | MC Messages | Updated December 11, 2023: We have updated the content below for clarity. Thank you for your feedback.
Microsoft will stop honoring the mail flow rule which helps you track end user reporting. To improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently, we moved the submission service ahead of the exchange transport rule agent. Now the mail flow rules (or exchange transport rules) which you have for the following addresses – phish@office365.microsoft.com, junk@office365.microsoft.com, not_junk@office365.microsoft.com, phish@senpluspluseop.onmicrosoft.com, unjunk@senpluspluseop.onmicrosoft.com and junk@senpluspluseop.onmicrosoft.com won’t be honored as the agent won't be receiving signals for these addresses. Moreover, the message tracking logs will show that reports going to phish@office365.microsoft.com, junk@office365.microsoft.com and not_junk@office365.microsoft.com as deleted or failed. For example: [{LED=550 4.3.2 QUEUE.TransportAgent; message deleted by transport agent};{MSG=};{FQDN=};{IP=};{LRT=}]. Please ignore it as it is by design while we look for a better way to address it. [When this will happen:] We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by late January 2024. | Updated January 30, 2024: We have updated the content below for clarity. Thank you for your feedback.
Microsoft will stop honoring the mail flow rule which helps you track end user reporting. To improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently, we moved the submission service ahead of the exchange transport rule agent. Now the mail flow rules (or exchange transport rules) which you have for the following addresses – phish@office365.microsoft.com, junk@office365.microsoft.com, not_junk@office365.microsoft.com, phish@senpluspluseop.onmicrosoft.com, unjunk@senpluspluseop.onmicrosoft.com and junk@senpluspluseop.onmicrosoft.com won’t be honored as the agent won't be receiving signals for these addresses. Moreover, the message tracking logs will show that reports going to phish@office365.microsoft.com, junk@office365.microsoft.com and not_junk@office365.microsoft.com as deleted or failed. For example: [{LED=550 4.3.2 QUEUE.TransportAgent; message deleted by transport agent};{MSG=};{FQDN=};{IP=};{LRT=}]. Please ignore it as it is by design while we look for a better way to address it. [When this will happen:] We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by mid-February 2024 (previously late January). |
2024-01-31 | MC Last Updated | 12/11/2023 20:40:57 | 2024-01-30T23:53:53Z |
2023-12-12 | MC Messages | Updated November 27, 2023: We have updated the content below for clarity. Thank you for your feedback.
Microsoft will stop honoring the mail flow rule which helps you track end user reporting. To improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently, we moved the submission service ahead of the exchange transport rule agent. Now the mail flow rules (or exchange transport rules) which you have for the following addresses – phish@office365.microsoft.com, junk@office365.microsoft.com, not_junk@office365.microsoft.com won’t be honored as the agent won't be receiving signals for these addresses. Moreover, the message tracking logs will show that reports going to phish@office365.microsoft.com, junk@office365.microsoft.com and not_junk@office365.microsoft.com as deleted or failed. For example: [{LED=550 4.3.2 QUEUE.TransportAgent; message deleted by transport agent};{MSG=};{FQDN=};{IP=};{LRT=}]. Please ignore it as it is by design while we look for a better way to address it. [When this will happen:] We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by late January 2024. | Updated December 11, 2023: We have updated the content below for clarity. Thank you for your feedback.
Microsoft will stop honoring the mail flow rule which helps you track end user reporting. To improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently, we moved the submission service ahead of the exchange transport rule agent. Now the mail flow rules (or exchange transport rules) which you have for the following addresses – phish@office365.microsoft.com, junk@office365.microsoft.com, not_junk@office365.microsoft.com, phish@senpluspluseop.onmicrosoft.com, unjunk@senpluspluseop.onmicrosoft.com and junk@senpluspluseop.onmicrosoft.com won’t be honored as the agent won't be receiving signals for these addresses. Moreover, the message tracking logs will show that reports going to phish@office365.microsoft.com, junk@office365.microsoft.com and not_junk@office365.microsoft.com as deleted or failed. For example: [{LED=550 4.3.2 QUEUE.TransportAgent; message deleted by transport agent};{MSG=};{FQDN=};{IP=};{LRT=}]. Please ignore it as it is by design while we look for a better way to address it. [When this will happen:] We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by late January 2024. |
2023-12-12 | MC Last Updated | 11/27/2023 20:43:05 | 2023-12-11T20:40:57Z |
2023-11-28 | MC prepare | If you are routing report messages to a mailbox, we recommend going to user reported settings and under "reported message destinations", setting the "send reported messages" to "My reporting mailbox only" and then providing the mailbox address you are routing to. Distribution groups and routing to an external or on-premises mailbox aren't allowed.
If you are routing report messages to a mailbox for a particular report type, take the above step and create rules in the mailbox using the outlook client. You can specify which report "phish" or "junk" or "not junk", you want to be ignored and filtered from your view. The report type is specified in the subject of the notification email sent to the mailbox. If you are routing report messages to Microsoft via a custom add-in or another mechanism, we recommend either using the report button in Outlook for web or the report message add-in or the report phish add-in as described here. https://learn.microsoft.com/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure? https://security.microsoft.com/securitysettings/userSubmission https://support.microsoft.com/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59 | If you are routing report messages to a mailbox, we recommend going to user reported settings and under "reported message destinations", setting the "send reported messages" to "My reporting mailbox only" and then providing the mailbox address you are routing to. Distribution groups and routing to an external or on-premises mailbox aren't allowed.
If you are routing report messages to a mailbox for a particular report type, take the above step and create rules in the mailbox using the outlook client. You can specify which report "phish" or "junk" or "not junk", you want to be ignored and filtered from your view. The report type is specified in the subject of the notification email sent to the mailbox (1| for Junk, 2| for Not junk, 3| for Phishing). If you are concerned that your phish simulations will get analyzed by Microsoft, please add the third party phish simulation tool as phish simulation under advanced delivery. With this change, the phish simulation will get delivered unfiltered and on user report, it won’t be analyzed by Microsoft. It will even show up as a phish simulation in the user report tab of submissions. If you are using exchange transport rule to forward phish simulation from user report to third party tool, we recommend going to user reported settings and under "reported message destinations", setting the "send reported messages" to "Microsoft and My reporting mailbox only" or “My reporting mailbox only”. Then provide a mailbox address you want the user report to route to (not the third party mailbox). Distribution groups and routing to an external or on-premises mailbox aren't allowed for this address. Now you configure an exchange transport rule which forward phish simulation coming to this mailbox address to the third-party tool. If you are routing report messages to Microsoft via a custom add-in or another mechanism, we recommend either using the report button in Outlook for web or the report message add-in or the report phish add-in as described here. https://learn.microsoft.com/microsoft-365/security/office-365-security/advanced-delivery-policy-configure?view=o365-worldwide https://learn.microsoft.com/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure? https://security.microsoft.com/securitysettings/userSubmission https://sip.security.microsoft.com/reportsubmission?viewid=user https://sip.security.microsoft.com/securitysettings/userSubmission https://support.microsoft.com/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59 |
2023-11-28 | MC MessageTagNames | User impact, Admin impact, Retirement | Updated message, User impact, Admin impact, Retirement |
2023-11-28 | MC Last Updated | 11/16/2023 05:14:23 | 2023-11-27T20:43:05Z |
2023-11-28 | MC Messages | Microsoft will be retiring the mail flow rule which help you track end user reporting. This change is being made to improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently.
[When this will happen:] We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by late January 2024. | Updated November 27, 2023: We have updated the content below for clarity. Thank you for your feedback.
Microsoft will stop honoring the mail flow rule which helps you track end user reporting. To improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently, we moved the submission service ahead of the exchange transport rule agent. Now the mail flow rules (or exchange transport rules) which you have for the following addresses – phish@office365.microsoft.com, junk@office365.microsoft.com, not_junk@office365.microsoft.com won’t be honored as the agent won't be receiving signals for these addresses. Moreover, the message tracking logs will show that reports going to phish@office365.microsoft.com, junk@office365.microsoft.com and not_junk@office365.microsoft.com as deleted or failed. For example: [{LED=550 4.3.2 QUEUE.TransportAgent; message deleted by transport agent};{MSG=};{FQDN=};{IP=};{LRT=}]. Please ignore it as it is by design while we look for a better way to address it. [When this will happen:] We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by late January 2024. |
2023-11-28 | MC Title | Microsoft to stop honoring mail flow rules tracking user reporting | (Updated) Microsoft to stop honoring mail flow rules tracking user reporting |
2023-11-28 | MC How Affect | You will no longer be able to track end user report using these mail flow rules, once the change gets implemented. | You will no longer be able to track end user report using mail flow rules for the following addresses – phish@office365.microsoft.com, junk@office365.microsoft.com, not_junk@office365.microsoft.com once the change is implemented. |
2023-11-16 | MC Messages | Microsoft will be retiring the mail flow rule which help you track end user reporting from November middle. This change is being made to improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently.
[When this will happen:] We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by late January 2024. | Microsoft will be retiring the mail flow rule which help you track end user reporting. This change is being made to improve the availability and reduce the latency of the submission service so that you can respond to threats (false negatives) more quickly and efficiently.
[When this will happen:] We'll be gradually rolling this out to customers starting late December 2023 and the roll out will be completed by late January 2024. |
2023-11-16 | MC Last Updated | 11/16/2023 00:54:42 | 2023-11-16T05:14:23Z |
*starting April 2022
Last updated 6 months ago