Retroactive threat scan in MailGuard

The scan looks at what is already sitting in the mailboxes. Not what arrives, but what has arrived: messages a filter let through days or weeks ago that are known to be dangerous today.

There are two occasions for it. Before a migration it answers what the previous gateway missed, and the answer is a list with subject and sender instead of a number from a brochure. After the migration it is the same question in reverse, for when a signature or a reputation entry only appears later.

What the scan does

For each mailbox it reads the message list of a chosen time window and checks two things:

• the sender domain against the Spamhaus domain list,
• the attachments against the Spamhaus hash list.

The message body is not loaded. That is deliberate: a scan that fetches every body is a data outflow the size of the mailbox, and it would be so slow that nobody would run it. Attachments are only fetched for messages that have them, and only up to a size limit.

What it does not do

It changes nothing. No message is moved, labelled or removed. Removal is decided by a remediation run, and that needs approval. The scan is a piece of information.

And it declares nothing harmless. A finding means: this sender domain or this attachment is listed. A message without a finding has not been checked and cleared, it simply did not stand out.

Prerequisite

Access to the mailboxes, meaning the Mail.ReadWrite permission on the Microsoft 365 tenant. It is granted in the MailGuard settings, the same consent as for later remediation. Without it the button stays disabled.

Course and duration

The scan runs in slices. A tenant with three hundred mailboxes and a thirty-day window easily has a hundred thousand messages; that does not fit into one pass. The run remembers which mailbox is next and where within it, and advances a slice every three minutes. Progress is shown on the card, you can cancel at any time, and cancelling costs one slice rather than the whole run.

A mailbox Microsoft will not hand over, for instance because it was deleted or is not a mailbox at all, does not hold up the run. It is skipped and the reason is recorded.

What is stored

For every finding the header data and the reason: mailbox, sender, subject, time, message identifier, and for an attachment hit its name and hash. Never the message content and never the attachment itself.