Viewing Subject Tag Issues Related to Office 365

Issue:

If you are using the Impersonation Protection feature within the Email Threat Protection service to configure subject tags and the Customer’s email is hosted on Office 365, you may experience a Microsoft Office 365 display-related issue that will prevent you from viewing the tagged subject when previewing the message in your inbox. The Impersonation Protection feature is successfully tagging the subject from the Email Threat Protection system, but the Office 365 mailboxes on the Microsoft side could intermittently have issues causing that tagged subject to NOT display. If you suspect a message should have been tagged with the Impersonation Protection feature, you can confirm by opening that message into its own window via your Outlook desktop application or Outlook Web Access (OWA). An opened message will show the tagged subject vs. a previewed message that will not. 

Scenario:

Below is a walkthrough scenario where we will start at the Impersonation Protection feature via Appriver’s Email Threat Protection service and show you a test example where this issue is replicated and show you the work around to confirm a message was tagged with Impersonation or not.

1. Jack Skinner is added as a Display Name to protect.


2. Settings show action set to Tag Subject With "WARNING - CHECK EMAIL".


3. Jack Skinner sent external tests from jskinner@appriver.com: one to jack@jayayeseakay.co.uk and another to AppriverTest@jayayeseakay.co.uk. Email Threat Protection tagged both subjects with a warning for failing the IMPERSONATION test.


4. Both messages still show the tagged subject when tracking it within Office 365 too.


5. However, the tests to both jack@jayayeseakay.co.uk and AppriverTest@jayayeseakay.co.uk in the Office 365 inbox through OWA do not show the tagged subjects when in the preview mode.



6. But if you open the messages in their own window, you will see the tagged subject.


Resolution:

By default, the Set Test Failure Action setting is set to Tag Subject With, the option that was discussed above. We recommend changing the Set Test Failure Action to Hold in Quarantine. This will cause messages that fail Impersonation Protection to be held in our Email Threat Protection Quarantine instead of delivering to your Office 365 inbox.


If you are still having issues, please contact Microsoft Support with the reference # 2103050040006871.