EndUserSpamNotificationFrequency < 4 Is OK?

[DavidTaig]

BP: Enable End-user Spam notification and set the frequency to 3 days . If customers have EndUserSpamNotificationFrequency = 1 or 2 this should be OK??

[cammurray]

It probably should be getting raised as informational, but the reason we recommended moving phish to quarantine was to stop these 'legitimate looking emails' from being in front of the user and risking them releasing it. Sending quarantine notifications every day is putting these emails in front of the user. For now this is as designed, but there may be a feature coming in product that might change that stance.

Thanks for logging though.

[DavidTaig]

Hi Cam
In the last 30 days the only "Prevented phish messages" were legit emails from Microsoft. I have surveyed a few folks and 1 Day is good, as most real Spam and Phish get caught as High, so they are not in the Spam Notification, just suspect and most times someone has signed up to that list or False Positive. With 3 Days you could get Notification on Wednesday and next is Saturday, so won't be until Monday you see the Notification for something got caught up on Wednesday afternoon

False Positive - Prevented phish messages
Sender: | microsoftsoys@email1.microsoft.com
Subject: | Thank you for joining us for the Empower your remote workforce webinar

Sender: | microsoftsoys@email1.microsoft.com
Subject: | Join us today's webinar: What's new and upcoming in OneDrive

Sender: | microsoftsoys@email1.microsoft.com
Subject: | Reminder about tomorrow's webinar - Empower your remote workforce with data security in OneDrive

[cammurray]

Cheers @DavidTaig

Decreasing the spam notification window isn't a great solution for false-positives. Whilst the notifications may show you the false-positives, they will also show messages designed to look legitimate too (but are in-fact, suspect). I'd encourage that you investigate these false-positives/report them to Microsoft via the plugin/or admin submissions. On face value with those messages, i'd suspect a high BCL.

[DavidTaig]

Thanks @cammurray

I thought I check the old FOPE settings
3 Days minimum - http://techgenix.com/transitioning-forefront-online-protection-exchange-fope-part5/
Spam Quarantine Notification
Notification interval in days (3-14)

EOP Spam notifications
https://protection.office.com/antispam
Default spam filter policy ‎(always ON)‎
Configure end-user spam notifications...
Send end-user spam notifications every (days)
3 (Default) 1 - 15 available

I provided an update on Microsoft IT offline ;)