Enforcement Flow

The Enforcement Flow shows the enforcement action taken by Microsoft and Check Point on an email. You can view the Enforcement Flow for an email in the Security Stack section of the email profile page.

Note:

The Enforcement Flow does not include manual actions taken on the email.

Depending on the Protection mode selected in the threat detection policy, the Enforcement Flow would be different.

  • Example of an email inspected by a policy in Prevent (Inline) protection mode.

    Microsoft finds the email Clean and intends to deliver it to the user's mailbox; Check Point scans the email, finds it Malicious, and quarantines it before it gets to the user's mailbox since it's inspected by a Prevent (Inline) policy.

    • Microsoft finds the email Clean and intends to deliver it to the user's mailbox. Enforcement: Deliver to Inbox.

    • Check Point scans the email and finds it malicious. Check Point quarantines the email before it gets delivered to the user's mailbox and quarantines it. Enforcement: Quarantine.

  • Example of an email inspected by a policy in Detect & Remediate protection mode.

    • Microsoft finds the email Clean and delivers it to the user's mailbox. Enforcement: Deliver to Inbox.

    • Check Point scans the email and finds it malicious. Check Point pulls the email from the user's mailbox and quarantines it. Enforcement: Quarantine.

  • Example of an email inspected by a policy in Detect protection mode.

    • Microsoft finds the email Clean and delivers it to the user's mailbox. Enforcement: Deliver to Inbox.

    • Check Point only scans the email and does not perform any enforcement as the policy protection is in Detect mode. Enforcement: Deliver to Inbox (Monitoring).

  • When Email Security is configured to automatically restore emails quarantined by Microsoft 365 for being High Confidence Phishing, and if Check Point classifies them as Clean.

    • Microsoft finds the email High Confidence Phishing and quarantines it.

    • Check Point scans the email and finds it clean. Check Point restores the email to the user's inbox.

    For information about how to configure Email Security to automatically restore emails quarantined by Microsoft 365 for being High Confidence Phishing, see Overriding Microsoft's False Positive Detections.