Ok had the same issue as others except with sharepoint.com
It was difficult to figure out, as these services are turned on by default.
Yes the current design the function of IP Reputation is enable in default settings,
For IP reputation block IP address, would you share the IP address list that was blocked to us?
We will compare with the cloud database and evaluate if we’re going to add them into our signature database.
We've had to disable the Phishing IP Block on our ATPs for now.
Would you share the IP address list that was blocked by the device?