So we have one particular client that one of our teams is working with. This one user sending emails to and from one of our users was flagged for every email between them.

Weird part starts here: It's only between these two. The same exact email chain sent to anyone else doesn't get flagged.

But after confirming it's safe, I allowed it through proofpoint.

Now the problem is that the email gets delivered to the user's inbox (I've confirmed via both defender explorer and exchange mail trace) and then disappears. I confirmed through exchange online powershell that none of the user's rules are affecting this email. I've logged into the mailbox myself on outlook online to confirm that it is indeed missing.

I have allowed this person through our anti-phishing and anti-malware threat policies. I've done everything I can possibly think of. I reported all of the emails as confirmed safe to Microsoft.

In defender, for the hell of it, I moved the email to the inbox, and it says action completed. But when I try to move it again, it says remediation failed, and the only thing I can see as a problem is that the email cluster shows suspicious, even after allowing it through everything.

I'm completely at my wits end. AI keeps shouting about ZAP, but we don't have any ZAP policies that I've seen, and I've allowed them through everything else.

Short of completely nuking the mailbox and recreating it, I'm at a loss.