SaaS Security - Office 365 Email - Disabling Inline Protection

If you believe you are experiencing an email deliverability issue related to Avanan, there are several options to remove the service from your mail flow. You may choose to:

  1. Select an alternate protection policy
    • Detect and prevent
    • Monitor only
  2. Stop the Avanan service

Selecting an alternate protection policy

  1. Navigate to Policy from the left navigation.
  2. Select the Rule for which you have Protect (Inline) protection mode.
  3. Change the protection mode to Detect and Prevent or Monitor Only.
  4. Click Save and Apply.

change-policy-mode

Stopping the Avanan service

  1. Navigate to Policy from the left navigation.
  2. Select the Rule for which you have Protect (Inline) protection mode.
  3. Change the Rule State to Stopped.
  4. Click Save and Apply.

Stopping-a-policy-rule

Note: These options will remove Avanan from your organization’s mail flow by disabling the “Avanan Protect” transport rule in Microsoft Exchange. Avanan will continue to scan the journaled copies of the emails, and the dashboard will continue to be populated with detections. In Detect and Prevent mode, your workflows (sending alerts, quarantining, etc.) will still be in place, but will be actioned via API after the mail reaches the inbox.

If you cannot log into the Avanan portal, you may take action from within the Exchange Admin Center to disable the Avanan Protect transport rule.

  1. Disable the login access for avanan-service-user
  2. Navigate to Mail Flow Rules
  3. Uncheck the Avanan - Protect rule

Note: If you do not disable the login access for avanan-service-user, the Avanan - Protect rule will be automatically recreated.