Bypass Office365 ATP scan for internal users

Issue Definition:

ATP scan takes too long for internal domain users, once the mail that was delivered from an external user has been scanned, it should not be scanned again, incase the mail is needed to be forwarded internally or a new file is to be shared from an internal user to another internal user, is there any whitelist option or bypass ATP scan from my internal users?

The answer is yes, it can be allowed to bypass email scanning internally, but this is something that has to be done via Exchange admin center transport rules and there is no such option available in ATP settings/policies

ATP Link Bypass Rule

Below are the steps to set up a mail flow rule to bypass ATP link processing:

1. Create a new mail flow rule in your Exchange/Office Admin center.
2. Name the rule, for example, Bypass ATP Links
3. Click more options.

           Apply this rule if….

           Senders IP address is in the range( Internal IP's)

           23.21.109.197

           23.21.109.212

           192.254.121.248

           Do the following…

           Set the message header…

           X-MS-Exchange-Organization-SkipSafeLinksProcessing

           To this value…

           1

           Save your new rule.

ATP Attachment Bypass Rule

Below are the steps to set up a mail flow rule to bypass ATP Attachment Processing:

1. Create a new mail flow rule in your Exchange/Office Admin center.
2. Name the rule, for example, Bypass ATP Attachments
3. Click more options.

           Apply this rule if….

           Senders IP address is in the range…

           23.21.109.197

           23.21.109.212

           192.254.121.248

           Do the following…

           Set the message header…

           X-MS-Exchange-Organization-SkipSafeAttachmentProcessing

           To this value…

           1

           Save your new rule.

However, if you do not want to verify by sender IP, you can also use the sender domain, but this would be a little less secure

It may take some time to work for this rule.