At Adler our email provider, Microsoft Exchange, scans incoming messages for potentially dangerous or unwanted content. Messages suspected of being one of these are held in quarantine. Exchange's scanning capabilities are constantly improving and can better figure out what messages we want or don't want if we give it examples of false positives and false negatives. This guide covers how to report false negatives, (unwanted messages that should have been quarantined) to Microsoft so similar messages can be caught in the future, as well as how to release false positives (good messages that shouldn't have been quarantined) back to the inbox and report them to Microsoft so similar messages won't be quarantined in the future.
Report dangerous or unwanted email
If you receive email that is dangerous or unwanted, select one or more messages, click Report from the menu, then select Report phishing or Report junk in the dropdown depending on which it is. You can also select these options from the right-click context menu.
Email reported as junk will be moved to the junk email folder. Email reported as phishing will be deleted. Messages similar to messages you report will be quarantined in the future.
If you accidentally report an email that you didn't mean to as junk, find the email in your junk folder. Select the email and click Report from the menu then select Report not junk. You can also select this option by right-clicking the email. If you have accidentally reported an email as phishing, find the email in the Deleted items folder. Right-click the email and select Restore.
Release quarantined email and report false positives
You may view your quarantined emails anytime by navigating to, https://security.microsoft.com/quarantine. You will also get email reports when messages are sent to quarantine. Locate one or more messages in quarantine and confirm they are the false positives you want to release. You may view details about the message by selecting it anywhere other than the check box.
To release the message from quarantine, select the message and then select Release from the menu. Check the box that says Report message as having no threats to report the message as a false positive and help the scanning function get better at identifying if similar messages are threats in the future. At the bottom, select Release message to return the message to your inbox.
Repeated false positives
Releasing a message to your inbox and selecting Report message as having no threats sends data to Microsoft about false positives indicating information on the type of mail that may look like spam but is not. This won't necessarily allow all subsequent mail from a sender through. According to Microsoft's documentation and our testing, we do not have a definitive number for how many reports this will take. In some instances, especially with mass emails and listservs, senders may use elements or sending methods in their emails that are very frequently associated with spam and unwanted email. We can only improve the algorithm over time by giving it more data and it's possible that data may conflict with other reports saying the same methods and sometimes even the same senders are sending unwanted email.
If you have any questions about false positives you have submitted multiple times, please feel free to open an incident ticket at support.adler.edu and include the sender email address and two or three of the most recent times the email was sent and ended up in quarantine.