Phishing links detected but action performed is Allow through [Kaspersky Security for Microsoft Office 365]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

Scenario:

Phishing links are detected but some emails are allowed through, even though the selected Action is Move to Junk Email folder .

Solution:

The original e-mail was already located in the Junk folder when our product started to scan it.

The "Allow through" action was performed, in this case it means that we've added the phishing tag to the e-mail and left it in the Junk folder.
Most likely this e-mail was detected by some third-party anti-malware/phishing solution (Microsoft anti-malware filters in EWS, for example) and was moved to Junk, then we've scanned it and there was nothing to do with it except adding the tag to it.