Solved: Re: Attachments randomly omitted from When a new e...

Kikoger · ‎07-07-2020

Hi all,

we have a flow triggered by "When a new email arrives (V3)"."includeAttachments" is set to true. Subject and fetchOnlyWithAttachment filter is active. The trigger triggers fine and returns "hasAttachment":"True", but the attachment array is empty in about 60% of cases. A re-run of that instance will return the same result for that email. The email all come from the same address and have the same file attached. I can send the same email 10 times and about 6 of them will have empty attachment arrays.

TRIGGER

{
  "subscribe": {
    "method": "post",
    "queries": {
      "folderPath": "Id::AAMk###################kAAA=",
      "importance": "Normal",
      "fetchOnlyWithAttachment": "True"
    },
    "body": {
      "NotificationUrl": "https://prod-85.westeurope.logic.azure.com/workflows/d7a###############838b0902/triggers/On_new_email_with_attachment/versions/085##########593466/run?api-version=2016-06-01&sp=%2Ftriggers%2FOn_new_email_with_attachment%2Fversions%2F085##########3466%2Frun%2C%2Ftriggers%2FOn_new_email_with_attachment%2Fversions%2F08#############93466%2Fread&sv=1.0&sig=JGjlEe5AZXfT_Zgkj_q3################"
    },
    "pathTemplate": {
      "template": "/GraphMailSubscriptionPoke/$subscriptions"
    }
  },
  "fetch": {
    "method": "get",
    "queries": {
      "folderPath": "Id::AAMkAGYxN#######################################AAA=",
      "from": "bus#############ytics@a######s.com",
      "importance": "Normal",
      "fetchOnlyWithAttachment": "True",
      "includeAttachments": "True",
      "subjectFilter": "UA#############on"
    },
    "pathTemplate": {
      "template": "/v3/Mail/OnNewEmail"
    }
  },
  "host": {
    "api": {
      "runtimeUrl": "https://flow-apim-europe-001-francecentral-01.azure-apim.net/apim/office365"
    },
    "connection": {
      "name": "/providers/Microsoft.PowerApps/apis/shared_office365/connections/shared-offic###############381ea35"
    }
  },
  "authentication": {
    "scheme": "Key",
    "parameter": "*sanitized*",
    "type": "Raw"
  }
}

RESPONSE BODY

{
  "headers": {
    "Pragma": "no-cache",
    "Transfer-Encoding": "chunked",
    "Retry-After": "3600",
    "Vary": "Accept-Encoding",
    "x-ms-request-id": "87de0c68-f46##############cc-28df-459e-b751-19272e4c035c",
    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
    "X-Content-Type-Options": "nosniff",
    "X-Frame-Options": "DENY",
    "Timing-Allow-Origin": "*",
    "x-ms-apihub-cached-response": "false",
    "Cache-Control": "no-store, no-cache",
    "Date": "Mon, 06 Jul 2020 05:34:44 GMT",
    "Location": "https://flow-apim-europe-001-francecentral-01.azure-apim.net/apim/office365/shared-office365############a972-da5e4381ea35/v3/Mail/OnNewEmail?folderPath=Id%3a%3aAAM##############%3d",
    "Set-Cookie": "ARRAffinity=5946df#############4773;Path=/;HttpOnly;Domain=office365-ne.azconn-ne-01.p.azurewebsites.net",
    "Content-Type": "application/json; charset=utf-8",
    "Expires": "-1",
    "Content-Length": "1362"
  },
  "body": {
    "id": "AA#############dAAA=",
    "receivedDateTime": "2020-07-06T05:34:40+00:00",
    "hasAttachments": true,
    "internetMessageId": "<0C90###########I04OCP2G3@qliknprp1>",
    "subject": "UAT-AF-Disruption",
    "bodyPreview": "Hello  Y##########U,\r\n\r\n\r\nPlease find the attached report:\r\n\r\n%%ReportName_RPT_D##############r\nThanks",
    "importance": "normal",
    "conversationId": "AAQk###################je7jJFk=",
    "isRead": false,
    "isHtml": true,
    "body": "<html><head>\r\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"><meta content=\"text/html; charset=utf-8\"></head><body><p><span class=\"rangySelectionBoundary\">&#65279;</span><span class=\"rangySelectionBoundary\">&#65279;</span>Hello&nbsp; Y###########EU,<span class=\"rangySelectionBoundary\">&#65279;</span><br></p><p><br></p><p>Please find the attached report:</p><p>%%Repo##############36f215%%</p><p><br></p><p>Thanks</p></body></html>",
    "from": "busi#############ics@a###############.com",
    "toRecipients": "ym###############us.com",
    "ccRecipients": null,
    "bccRecipients": null,
    "attachments": []
  }
}

Any ideas?

Thanks

rohsh354 · ‎07-07-2020

Hello,

There is a known limitation in Office 365 Outlook connector when ATP scan is enabled.

https://docs.microsoft.com/en-us/connectors/office365/

"If Advanced Threat Protection (ATP) Scan configured on email attachments, trigger may run twice on receiving new email. As a workaround for emails with attachments, please have a condition after the trigger which verifies whether the length of attachments array is greater than 0."

Please be informed that there have been scenarios in the past as well, wherein ATP scan causes issues with triggering the flow or the attachments. When administrator configure ATP with dynamic delivery option, then it delivers messages immediately and replaces attachments with a placeholder file until scanning is complete, and then reattaches the attachments if no malware is detected. This causes the Flow to run twice occasionally or not recognize the attachment properly on the first run.

As mentioned in the documentation below, please check if the ATP policy option can be changed to Replace. This will ensure that you get only one email after ATP scan is completed and the message identifier remains same.

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-atp-safe-attachme...

Hope this helps !

View solution in original post

Kikoger · ‎07-07-2020

Through trial and error we were able to find out the following:

-We have Microsoft Threat Protection on our mailboxes;

-For non-Active Directory emails, it screens the email and and the attachment is therefore not available by the time the trigger is contacted.

We tried to put in a delay of a couple of minutes, but, at the end of the screening, the Message Id changes (???!!!) so the message cannot be retrieved using the Id in the trigger.

Very odd......

rohsh354 · ‎07-07-2020

Hello,

There is a known limitation in Office 365 Outlook connector when ATP scan is enabled.

https://docs.microsoft.com/en-us/connectors/office365/

"If Advanced Threat Protection (ATP) Scan configured on email attachments, trigger may run twice on receiving new email. As a workaround for emails with attachments, please have a condition after the trigger which verifies whether the length of attachments array is greater than 0."

Please be informed that there have been scenarios in the past as well, wherein ATP scan causes issues with triggering the flow or the attachments. When administrator configure ATP with dynamic delivery option, then it delivers messages immediately and replaces attachments with a placeholder file until scanning is complete, and then reattaches the attachments if no malware is detected. This causes the Flow to run twice occasionally or not recognize the attachment properly on the first run.

As mentioned in the documentation below, please check if the ATP policy option can be changed to Replace. This will ensure that you get only one email after ATP scan is completed and the message identifier remains same.

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-atp-safe-attachme...

Hope this helps !

Kikoger · ‎07-08-2020

Thanks @rohsh354 - we suspected something like this, but had nowhere to go from there, so thank you! I will pick this up with our messaging team.

In the meantime, we have implemented a workaround:

As you mention, this triggers the Flow twice, or sometimes even three times, but for the actions that follows that's not relevant.

Thank you again for your help and regards,

Max

rohsh354 · ‎07-08-2020

@Kikoger - Good to know. Please consider marking this thread as Solved, if the suggestions helped. It can give helpful guidance to others in the community in similar situation.

Cheers !