Barracuda Networks currently uses mail flow rules to manage mail flow with Microsoft 365, meaning all email from the internet must first be filtered by Barracuda Networks before being routed to Microsoft 365. When using the mail flow rule method, all emails are given a spam confidence level (SCL) of -1 which will ensure that emails from Barracuda Networks are delivered to the user's inbox and not the junk folder or hosted quarantine. Any blocked senders that a user has configured will continue to be placed into their junk folder even though we set the SCL to -1 using the mail flow rule. Customers using the mail flow rule method might receive alerts from Microsoft for an ETR override alert. Phish delivered due to an ETR override is an alert generated by Microsoft that identifies an email as potential phishing and would have put the email into the junk folder, but because of the mail flow rule, that action was not taken. For more information, see Enhanced Connectors vs. Mail Flow Rules for Spam Filtering.
Use the following instructions to disable the ETR alerts:
View the alert policy:
Microsoft Purview compliance portal – Log into the compliance portal https://compliance.microsoft.com, and then select Policies > Alert > Alert policies.
Microsoft 365 Defender portal – Log into the Microsoft 365 Defender portal https://security.microsoft.com/ and under Email & collaboration select Policies & rules > Alert policy. Alternatively, you can go directly to https://security.microsoft.com/alertpolicies .
Search for "ETR" and then click Phish delivered due to an ETR override to edit.
- Turn off the alert policy from the Status toggle.
