Empty email attachments due to ATP (Advanced Threat Protection) scan in progress

[ckrybus]

Since a few days I'm getting HTTPError: 404 Client Error: Not Found for url: https://graph.microsoft.com/v1.0/users/[email protected]/messages/some-long-base64-encoded-string-here==/$value | Error Message: The specified object was not found in the store. errors. errors sporadically.

It turns out Microsoft's Office 365 Advanced Threat Protection (ATP) is the culprit. When ATP is ON you can see the emails immediately after they have been received, you can also see how many attachments each email has and even see the attachment file names. But as long as the ATP scan is in progress you cannot download the attachments. The web interface shows an "ATP Scan in progress" message, but o365 sees only that the attachments are empty.

As a quick fix each message needs to sit 10 minutes in the inbox before my script fetches it.

A better solution would be to somehow determine if the attachments are ready for download and only then proceed with the download. Currently I do not see such option in o365.

In the graphql Playground I saw a deviceThreatProtectionLevel enum, does anyone know how to get this information in o365?

[alejcas]

Check ms graph docs. If it's possible there it's possible in O365.