Description
Shield provides an X-ray for each message delivered to the Outlook Mailbox or to Shield Jail. The Timeline tab of the X-ray shows a history of the message's movement before, during, and after Shield is in possession of it.
Because Shield timelines capture all changes to a message’s location, actions performed by users or their Outlook client will appear in the message timeline.
Microsoft Mailbox Cleanup Actions
Sweep, Archive, and Other Microsoft Organization Tools
Microsoft Outlook provides several mailbox management tools. Details about these options are available in their article Organize your inbox with Archive, Sweep, and other tools in Outlook on the web. These cleanup tools affect the location of messages, resulting in updates to the Shield X-ray Timeline for the message.
Sweep is a mailbox cleanup tool we have observed as in use during some investigations. Multiple messages from the same sender are moved from the Inbox to Deleted Items with identical or near-identical timestamps. This usually occurs when users run the Sweep function manually or have a scheduled Sweep configured in Outlook Web Access or the New Outlook.
The Sweep move is reflected in the Shield X-ray Timeline with the location shown as Deleted Items. Because Sweeps can run automatically, they may occur even when the user is not actively accessing their mailbox. In these cases, the Shield X-ray Timeline will display a timestamp corresponding to when the Sweep action occurred.
Message Rules
Outlook message rules may also impact the location of messages and, therefore, the Shield Timeline. We recommend checking for any message rules that might move individual messages as they are delivered. Please see Manage email messages by using rules in Outlook for more information about message rules and their effect on the Outlook mailbox.
Clutter
Also impacting the Shield Timeline is the Microsoft Clutter feature, which helps keep the Outlook Inbox focused by moving low-priority messages out of the way. It learns from the user's email habits and, based on past behavior, identifies messages they are likely to ignore intentionally. These messages are automatically placed in the Clutter folder, which can be reviewed at the user's convenience. For more information about the Clutter feature, please view Microsoft's article Use Clutter to sort low-priority messages in Outlook on the web.
Troubleshooting Suggestion
Any messages moved from the Inbox to another location when an Inbox is cleaned will appear in the Shield Timeline of the moved messages. We suggest exploring this possible reason for timeline changes when investigating issues with Shield messages.
Related to
Updated