When ATP Safe Attachments is enabled and using the Dynamic Delivery option, some emails are picked up by Dynamics before the scan is completed and the preview attachment is unreadable. When the scan completes the email with the broken attachment remains. Only if the scan is complete when CRM scans the mailbox are the attachments viewable. According to MS CRM support this is by design but breaks when Safe Attachments is enabled in this manner.

From MS support:
As far as I know after we enable ATP from Exchange, there will be 2 emails. One when it�s working (with a �scan in progress� attachment) and a second when it has completed(with the actual attachment). Both of the emails will have the same message id.

For current CRM Server-Side Sync design for email, the system will only track email with the same message id once to avoid duplication. Meanwhile, Server-Side Sync(SSS) will check each mailbox every 5 minutes to automatically track incoming emails.

So there will be 2 scenarios.
1. If user mailbox get the second email(with the actual attachment) before CRM tracking window, the email will be tracked to the system without any issue.
2. If CRM email tracking window is ahead of user receiving the second email, the first email will be tracked without actual attachment. When the second email comes, CRM system find it has the same email message id and ignore it.

It�s by design behavior at the moment, but we will check with our Product Team whether we will improve this integration in near future.

It would be really helpful if this could be fixed up.

Thanks,
Brad Rush