We have recently begun using Microsoft Advanced Threat Protection Attachment Scanning on all incoming email.  We have discovered that this is not playing friendly with ServiceDesk.  The issue is caused by the way that ATP will send the email along with a Preview link to the attachment rather than the full attachment.  It will later replace that email with one that contains the full attachment, but by then ServiceDesk has already fetched the email and created the ticket with the preview link, which is generally not useful for technicians.

Is there any way to resolve this from the ServiceDesk side of things?