Email Delay

The error message “400 4.7.721 Advanced Threat Protection scanning in progress” indicates that the delay is due to the Advanced Threat Protection (ATP) scanning process. This is a security feature that scans emails for potential threats before they are delivered to the recipient’s mailbox.

Possible Causes and Solutions:

ATP Scanning Delays:

• Cause: ATP scans can sometimes take longer, especially if the email contains attachments or links that need to be thoroughly checked.
  • Solution: This is generally expected behavior. However, you can review and adjust your ATP policies to see if there are ways to optimize the scanning process. For example, you might consider adjusting the Safe Attachments policy to use Dynamic Delivery, which allows the email body to be delivered while the attachment is being scanned1.
  Configuration Issues:

  - **Cause**: Misconfigurations in your ATP settings or email flow rules can also cause delays.
  
     - **Solution**: Verify that your ATP policies are correctly configured and that there are no conflicting rules that might be causing additional delays. You can use the following PowerShell command to check your Safe Attachments policy:
  
     ```
     Get-SafeAttachmentPolicy
     ```
  
     **Vendor-Specific Delays**:
  
        - **Cause**: If you are using an external email security partner, the delay might be on their end.
  
           - **Solution**: Contact your email security vendor to check if there are any known issues or delays with their service. They might be able to provide more specific insights or solutions.
  

Monitoring and Logs:

• Solution: Continuously monitor your message trace logs and ATP reports to identify patterns or recurring issues. This can help you pinpoint whether the delays are sporadic or consistent and whether they correlate with specific types of emails or senders.