Step-by-step: Metacompliance Bypass Checkpoint transport rule

1. Navigate to the rule
Go to Exchange Admin Center → Mail flow → Rules (or Microsoft Defender portal → Email & collaboration → Policies & rules → Mail flow → Rules).

2. Create the rule
Name it: Metacompliance Bypass Checkpoint

3. Set the condition

• Apply this rule if: The sender → IP address is in any of these ranges or exactly matches
• Enter your Metacompliance sending IP range(s), shown here.

4. Set the actions (add both, in this order)

• Action 1: Modify the message properties → set a message header
• Header name: X-CLOUD-SEC-AV-Info
• Header value: enteryourcheckpointappnamehere,office365_emails,inline
• Action 2 (add via the +): Stop processing more rules

This second action is the critical piece that was missing — without it, Exchange keeps evaluating lower-priority rules (like Check Point - Protect) even after this one fires, which is why mail was still routing to Check Point.

5. Except if
Leave blank unless you need to exclude specific senders/recipients from the bypass.

6. Set rule priority (Settings tab, or the rule list after saving)

• This rule's priority number must be lower than the Check Point - Protect rule's priority number (in Exchange, priority 0 runs first, then 1, 2, 3...).
• Go to Mail flow → Rules, and drag this rule (or set its Priority value) so it sits above Check Point - Protect in the list.
• Confirm by checking each rule's Priority field: e.g., if Check Point - Protect is currently priority 2, set this rule to priority 0 or 1 — anything numerically lower.

7. Save and test

• Save the rule.
• Send a test message from an IP in the allowed range.
• Run a Message Trace and confirm:
• Metacompliance Bypass Checkpoint fires
• Check Point - Protect does not appear in the trace afterward