Have had several reports that many attachments are being blocked in Office 365 ATP. It appears to be an issue with the ATP detonation when looking into the issue but will wait for Microsoft to release an official root cause.
Microsoft call was opened and shortly after a service degradation has been acknowledged.
EX180966 – Advanced Threat Protection (ATP) issue
Status:Service degradation
User impact:Users are not receiving emails or attachments that are incorrectly quarantined.
More info: Our analysis indicates that some emails with attachments are being incorrectly quarantined.
Current status: We’re continuing to work to release the quarantined messages and anticipate that this activity will take approximately four hours to complete. In parallel, we’re introducing a code change to allow the mechanism to quarantine messages as expected.
Scope of impact: This issue may affect any of your users that have mail and attachments scanned by ATP. Start time: Wednesday, May 29, 2019, at 12:07 PM UTC
Root cause: The mechanism responsible for evaluating whether an email or attachment is suspicious is encountering issues, which is causing some messages to be incorrectly quarantined.
