When you use Server-Side Synchronization with Dynamics 365 and Office 365 Advanced Thread Protection(ATP) is enabled, attachments may be missing from the email created in Dynamics 365. You may see an attachment included named “ATP Scan in Progress.eml”, but the original attachment is not added to Dynamics 365.
If ATP is configured with the safe attachment policy “Dynamic Delivery” and an email is received in the user's inbox with an attachment, 2 emails with the same email message id will exist. The user will receive the first one without the original attachment while ATP is scanning the attachments. The second email will replace the first one after the scanning completes.
The Server-Side Synchronization feature will only track emails with the same message id once to avoid duplication. If the second email doesn’t get to Exchange before the sync cycle starts from Dynamics 365, the original attachment may not be tracked to the system.
Use the “Replace” policy in ATP safe attachment configuration.
More information about ATP Safe Attachments policy options