Skip to main content
Safe Attachments detonates attachments in a sandbox. That detonation registers as an attachment open in your results, crediting an interaction to a user who never touched the file. A mail flow rule skips that processing for our mail.
Do Domain & IP whitelisting first. This is an addition to it, not a replacement.
1

Create a mail flow rule

In the Exchange admin center, create a new rule named something like Bypass Safe Attachments, and click More options.
2

Set the condition

From Apply this rule if, select The senders then IP address is in any of these ranges or exactly matches, and enter our sending IP addresses.
3

Set the action

From Do the following, select Modify the message properties then set a message header.Click the first Enter text link and set the message header to X-MS-Exchange-Organization-SkipSafeAttachmentProcessing. Click the second Enter text link and set the value to 1.
4

Save

Click Save.
If your attachment-open figures look implausibly high across the whole organisation rather than for particular people, Safe Attachments is the usual cause.

​
Then what

Have other security products enabled? Whitelist them now. Once everything that applies to your environment is whitelisted, send a test email from the platform and confirm every interaction is recorded. See Testing your whitelisting.