Microsoft 365 Defender - Email Threat Management
Suspected Spam, Phishing and Malware email is now being filtered to a Quarantine area by Exchange Online Protection. This allows you to safely view the email and decide whether it is legitimate mail that should be delivered to your Inbox, or unwanted mail that should be purged.
To check your Quarantined email, you can:
Please note that the Quarantine page, when loaded directly, will only show personal Quarantined messages. If you suspect that a message sent to a Shared Mailbox has been Quarantined, you will need to wait until that shared mailbox receives the Quarantine notification email from Microsoft.
Quarantined Email Notifications
If you receive an email from quarantine@messaging.microsoft.com with the subject "Microsoft 365 Security: You have messages in quarantine", it means Microsoft has detected one or more potentially unwanted emails that may require your attention.
- If you would like to get more information, select the Review Message button to be taken to the Quarantine page in the Microsoft Defender portal.
- If you are sure the email is legitimate and desired, select the Release button to have the email delivered to your Inbox
- Some messages flagged as high-confidence phishing emails will be unavailable for immediate Release; you must instead select the Request Release button. This will generate an ITS Support ticket; someone will soon be in touch to confirm that you want the email released and are willing to accept the risks, and then manually release the email for you.
Login to the Microsoft 365 Defender portal (if prompted). You should then be taken to the Quarantine page. From here you can review emails to decide if they are safe to be Released to your Inbox, or if they should be Removed from Quarantine (permanently deleted).
Uncertain Email
If you are unsure whether the email is legitimate/desired, it is recommended to use the Preview message option in the Microsoft Devender Quarantine page. This will show you the contents of the message, without any risk of triggering malicious attachments.
Example of previewing a Quarantined email:
If you are still unsure after the viewing the email preview, ITS is happy to assist. Please create an ITS Support ticket using this service: https://unbc.teamdynamix.com/TDClient/87/Portal/Requests/ServiceDet?ID=1152
Legitimate Mail (incorrectly Quarantined)
To release message(s) from the Quarantine page, checkmark the message(s) and then select the Release button at the top of the page. Alternately, click on the message subject to open the flyout panel, and select Release email from there. Either option will deliver the message to your Inbox.
Example of checkmark and Release on main page:
Example of using flyout panel for an individual message:
After choosing to Release a message, you can optionally "Report message as having no threats". This is recommended, as long as you are absolutely sure the email is legitimate and contains no threats. Microsoft will re-scan the message, and potentially adjust its filters to prevent similar messages from being Quarantined in the future.
After selecting the Release option one last time, you'll receive a confirmation that the message has been released.
Note: Some messages cannot be directly released; instead, you must select the Request release option. This will send a notification to IT, who will confirm that you actually want the message released (and accept all related risks), and then release the message once confirmed.
Unwanted Email
If you see message(s) in your Quarantine folder that are definitely unwanted, go ahead and select Delete messages (from the main page) or Delete from quarantine (in an individual message flyout). This will delete the message permanently. This is not necessary, as Quarantined emails are automatically deleted after 30 days, but it can be enjoyable.