Before
Analysts had to block the confirmed sender, search the tenant for copies, and identify each recipient holding a matching message. They then had to remove the messages or record that no copies were found.
How it works
- Receive the confirmed phishing case, calculate the seven-day lookback window, and request a 30-day sender block.
- Search analyzed tenant email for messages matching the sender or Internet Message-ID, then build recipient-specific cleanup targets.
- Remove matching copies when present, or return a sender-blocked-only result when the search finds none.
Workflow details
- Trigger and preparation: The flow starts with confirmed message details, including the sender, subject, message identifier, receipt time, and decision context. It builds a seven-day search window and prepares the sender-block request.
- Sender protection: The confirmed sender is added to the tenant block list with a 30-day expiration, helping prevent additional messages from that sender during the response period.
- Message discovery: The tenant is searched for analyzed email copies received during the calculated window. Messages are matched by sender address or Internet Message-ID, then expanded into recipient-specific remediation targets and counted.
- Conditional cleanup: If matching copies exist, the flow requests soft deletion of those messages and returns the remediated count. If no copies are found, it returns zero remediated messages with a sender-blocked-only status.
What changed
Sender blocking and copy discovery now begin automatically from the confirmed case, with matching messages routed to remediation only when the count is greater than zero. The response clearly separates completed cleanup from cases where only the sender block was applied.
Work removed
Manually blocking the sender, searching the tenant for matching messages, identifying every recipient copy, submitting removal requests, and recording a no-match result.
Expected outcome
Up to three recurring analyst actions per confirmed case are consolidated into one workflow, producing a consistent sender block and documented cleanup or no-match result.
