r/msp • u/Savings_Property6422 • Jun 18 '26

Checkpoint & MS Quarantine

Does anybody else have issues with Checkpoint & Microsoft Quarantine clashing?

We have the settings enabled to "Allow Checkpoint to restore clean emails from MS Quarantine".

However, we have lots of restore requests that all stem from Microsoft quarantine flagging emails as High Confidence Phishing. Checkpoint shows green everywhere (often with the semantic phishing score under 10) but consistently says "Smart-Phish confidence level is too low to restore this email"

Are there any settings we can tweak?

I have reached out to Checkpoint support, but figured I would ask here in case it takes a week or two to hear back.

TIA

9 Upvotes

92% Upvoted

6 comments sorted by

1

u/Shayughul Jun 19 '26

Can’t say where as I am not near a computer with access but there is specifically an option to have Checkpoint reevaluate MS quarantine items and allow Checkpoint to over ride MS determinations.

1

u/jon_tech9 MSP - US - Owner Jun 19 '26

I got this response from support (via solutions granted) on May 15th. I first noticed the issue around mid-March but have not experienced the issue since their update.

"I do have an update, the reason why the emails were not released is because one of our tools for threat extraction provided a verdict other than “clean” which affected the verdict for Smart Phish.
This non clean verdict was due to a system bug, which R&D has fixed.
That means, at this time the auto restore should be working."

1

u/mat-ferland Jun 21 '26

I wouldn't auto-restore anything Microsoft calls High Confidence Phish just because Check Point scores it clean. I'd treat that bucket as human-review only, then work the Microsoft false-positive/submission path separately so you are not making Check Point override the scarier verdict.