Account Security Problems

How to Fix Microsoft 365 Defender Sending Hundreds of ATP Malware Alerts

Aamir Naveed Akram Oct 26, 2026 870 views

Question details

The user is receiving nearly 1,000 overnight ATP malware detection alerts from a postmaster address without having made any policy changes.

How to Stop Microsoft 365 Defender from Sending Hundreds of ATP Malware Alerts

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Monitoring email security and dealing with an unexpected flood of automated threat notifications.
Observed behavior: Microsoft 365 Defender generates hundreds of ATP malware alerts regarding returned emails originating from a postmaster address, despite no system policy modifications.

Before you start

Ensure you are logged in with Global Administrator or Exchange Administrator credentials, as you will need elevated permissions to access and analyze the Microsoft 365 message trace logs.

Solution 1Recommended

Review Exchange Message Trace Logs for Suspicious Activity

Use the Exchange admin center to determine if an internal mailbox is compromised or if an external spammer is spoofing your domain.

A sudden influx of ATP malware alerts from a postmaster address usually points to non-delivery reports (NDRs) bouncing back to your domain. This happens either when an internal user's account is compromised and used to send outbound malware, or when an external entity sends malware while spoofing your organization's domain name.

Access the Exchange Admin Center

Sign in to the Microsoft 365 admin center, navigate to the left-hand menu, and select 'Exchange' under the Admin centers section.

Open Message Trace

In the Exchange admin center, click on 'Mail flow' in the navigation pane, then select 'Message trace'.

Run a Trace on Recent Activity

Start a new trace configuring the time range for the last 24 to 48 hours. Leave the sender and recipient fields blank, or specifically filter by the impacted domains or flagged IP addresses mentioned in the ATP alerts.

Analyze the Results

Review the trace results. Look for high volumes of outbound emails failing delivery. Determine if the originating IP addresses match your internal network (indicating a compromised account) or external unknown servers (indicating domain spoofing).

Review Exchange Message Trace Logs for Suspicious Activity

Account Security Check: If you identify a compromised internal mailbox, immediately reset the user's password, revoke all active sessions, and enforce Multi-Factor Authentication (MFA).

Solution 2

Escalate to Microsoft 365 Support

If message trace logs do not clearly identify the source of the malware alerts, escalate the issue for specialized administrator assistance.

Free Microsoft Office alternative

Switch to WPS Office for a Lightweight Document Solution

While Microsoft 365 handles complex enterprise email infrastructure and security policies, managing it can sometimes require heavy administrative effort. If you or your team members are looking for a reliable, safe, and robust desktop productivity suite without the complex server-side overhead, WPS Office is a superb choice.

Highly compatible with Microsoft Office formats including DOCX, XLSX, and PPTX.Lightweight design that runs smoothly on almost any device.Completely free basic version to easily handle your everyday document needs.Built-in PDF editing tools for secure and easy document management.Familiar user interface making migration from Microsoft Office seamless.

Frequently Asked Questions

Why am I receiving malware alerts from a postmaster address?

Postmaster addresses send automated bounce-back or non-delivery reports (NDRs). If an attacker sends malware-laden emails to invalid addresses using your domain, the recipient servers reject them and send the NDRs back to you, which then triggers your Defender ATP alerts.

How can I tell if my domain is being spoofed?

By reviewing the Exchange message trace logs, you can check the originating IP address of the flagged emails. If the IP address does not belong to your organization and the emails fail SPF, DKIM, or DMARC authentication checks, an external sender is spoofing your domain.

Will changing my Microsoft 365 Defender policies stop these alerts?

Lowering your security policies to hide the alerts is not recommended, as it can expose your organization to real threats. It is better to address the root cause by securing compromised accounts or tightening your DMARC records.

Can I bulk-dismiss these ATP malware alerts?

Yes, within the Microsoft 365 Defender portal, you can select multiple alerts from the incident queue and choose to resolve or dismiss them. However, you should only do this after investigating the root cause and securing your environment.

Microsoft Office Security Issues