A file can turn malicious anytime, even after it has reached user’s mailbox.
AMP can identify this as new information emerges and push retrospective
alerts to your appliance. With this release you get more than just alerting.
If your organization is using Office 365 to manage mailboxes, you can
configure your appliance to perform auto-remedial actions on the
messages in user mailbox when the threat verdict changes.

See the “Automatically Remediating Messages in Office 365 Mailboxes”
chapter in the user guide or online help.