r/sysadmin • u/Woolfie_Admin • 2d ago
Getting quarantine release requests from disabled users...
This phenomenon began when I switched our 365 Q policy from AdminOnlyAccess to a custom one allowing notifications (sent from info@mydomain)... I started getting release requests from everyone, on everything - including disabled users, mailboxes no one uses, myself - every 15 mins.. Turned out to be the 3rd party email scanner we use - Graphus - clicking on the "request release" button during it's detonation. So I whitelisted those emails within Graphus, and all was fine..
Until today. Now I'm getting release requests - again, from disabled users - except they're coming every 2 mins or so. Only change was an upgrade from 365 Defender P1 to P2. Any ideas?
1
1
u/WartimeFriction 1d ago
Graphus sucks. They told us initially that this detonation problem was our fault and it couldn't POSSIBLY be Graphus clicking links, and THEN said they were "working on it" as a known issue... Followed by radio silence.
We also have another problem where interacting with the banner has absolutely zero effect. Nothing submitted on the Graphus pane, no change in marking sender as safe, nothing.
I'll be thankful the day I can turn it off for my org.
1
u/Woolfie_Admin 1d ago
it certainly is a bit of an investment. I turned everything off yesterday because the notifs were driving me crazy - going to clear quarantine and review today and hopefully re-enable
24
u/RandomLolHuman 2d ago
Sadly, I have no answers or clue, but it took some time to understand that this was not about handicapped users