Urgent ESA Issue - 2021-09-24-1

Microsoft updated its Spam engine and rules earlier this week, and the customers we've heard from have reported this issue as now solved. We're sending the all-clear and marking this incident resolved. If you have any further concerns, please reach out to Cisco TAC.

Microsoft continues working on their machine learning algorithm to categorize encrypted envelopes accurately.
Microsoft's team is still working on a global and permanent fix.
Cisco continues submitting evidence to Microsoft for accelerating their machine learning input.
Cisco suggest to set up SPF, DKIM and DMARC records to mitigate the impact.
ETA for next update: Monday, October 18th, 2021.

Despite Microsoft deploying a workaround last Friday, October 1st, 2021, there is still a high influx of customers being impacted.
Microsoft's team is still working on a global and permanent fix.
Cisco continues submitting evidence to Microsoft that will be used for finding a resolution ASAP.
ETA for next update: Monday, October 11th, 2021.

Estimated time to resolve: Microsoft expects this issue to be completely resolved for all affected users by Friday, October 1, 2021.

Root cause: Due to the underlying machine learning logic utilized by Microsoft's anti-spam service, messages incorrectly identified as phish resulted in a poor reputation score for the sender and thus impact.

The issue has been identified and a fix is being pursued.

Cisco TAC has been receiving reports about email delivery issues when using CRES service, ESA on box encryption, and encryption portal service. If the end-users use Microsoft Outlook or O365 as the client, the encrypted emails are being classified as "High Confidence Phish" by Microsoft and either quarantined or sent to the Junk folder.



Who does it affect?

This only affects our customers who are using Cisco’s encryption service and sending encrypted emails to their clients/customers who use Microsoft O365. Clients using other email clients or services are not affected.



What is Cisco doing?

Cisco is continuing to work with Microsoft to address this issue.



What should customers do?

Microsoft will only respond to its own customers. If you are experiencing issues with the delivery of secure messages to Microsoft customers, we ask that you have your recipients escalate the issue to Microsoft.