> If outlook is clicking on links or buttons that generate POST requests It isn't though, it's loading URLs it finds in emails, and then runs scripts on those

> If outlook is clicking on links or buttons that generate POST requests It isn't though, it's loading URLs it finds in emails, and then runs scripts on those loaded websites, like many "modern" scrapers/crawlers. So if your JavaScript on that URL automatically does POST requests on load, those will happen automatically when their scanner loads the website. But if you instead don't do a POST request on JavaScript load, and do that request when the user presses an actual button on the loaded website, the scanner won't trigger that button automatically (that would be a whole new level of craziness, we're not there (yet)) So yes, it is a workaround. I've implemented this 10s of times already, because it's been an issue for a long time. Edit: The submission article also makes it abundantly clear that this is the very problem they're suffering from: > Microsoft’s security scanning will now not only visit the links you mail out, they will also run the JavaScript on your page, and will also send out any POSTs generated by that JavaScript: The problem is that their JavaScript automatically issues POST request on load, not that Outlook loads and executes JavaScript on the page (although that sucks too, don't get me wrong).