Manage quarantined messages and files as a user

In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, quarantine holds potentially dangerous or unwanted messages. For more information, see Quarantine in EOP.

As an ordinary user (not an admin), the default capabilities that are available to you as a recipient of a quarantined message are described in the following table:

In supported protection features, quarantine policies define what users are allowed to do to quarantined messages based on why the message was quarantined. Default quarantine policies enforce the historical capabilities for messages as described in the previous table. Admins can create and apply custom quarantine policies that define less restrictive or more restrictive capabilities for users. For more information, see Anatomy of a quarantine policy.

You view and manage your quarantined messages in the Microsoft Defender portal or (if an admin has set this up) quarantine notifications from quarantine policies.

What do you need to know before you begin?

• To open the Microsoft Defender portal, go to https://security.microsoft.com. To go directly to the Quarantine page, use https://security.microsoft.com/quarantine.

• Admins can configure how long messages are kept in quarantine before they're permanently deleted in anti-spam policies. Messages that have expired from quarantine are unrecoverable. For more information, see Configure anti-spam policies in EOP.

• By default, messages that were quarantined for high confidence phishing, malware, or by mail flow rules are only available to admins, and aren't visible to users. For more information, see Manage quarantined messages and files as an admin in EOP.

• For information about the order of precedence for user allows and blocks and organization allows and blocks, see User and tenant settings conflict.

• All actions taken by admins or users on quarantined messages are audited. For more information about audited quarantine events, see Quarantine schema in the Office 365 Management API.

Manage quarantined messages in EOP

View your quarantined messages

In the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Review > Quarantine > Email tab. Or, to go directly to the Email tab on the Quarantine page, use https://security.microsoft.com/quarantine?viewid=Email.

On the Email tab, you can decrease the vertical spacing in the list by clicking Change list spacing to compact or normal and then selecting Compact list.

You can sort the entries by clicking on an available column header. Select Customize columns to change the columns that are shown. The default values are marked with an asterisk (^*):

• Time received^*

• Subject^*

• Sender^*

• Quarantine reason^* (see the possible values in the Filter description.)

• Release status^* (see the possible values in the Filter description.)

• Policy type^* (see the possible values in the Filter description.)

• Expires^*

• Recipient^*

• Sender address override reason^*: One of the following values:

  • None
  • Message sender is blocked by recipient settings
  • Message sender is blocked by administrator settings

  Tip

  If a sender is blocked and Don't show blocked senders is selected (default), messages from those senders are shown on the Quarantine page and are included in quarantine notifications when the Sender address override reason value is None. This behavior occurs because the messages were blocked due to reasons other than sender address overrides.

• Released by^*

• Message ID

• Policy name

• Message size

• Mail direction

To filter the entries, select Filter. The following filters are available in the Filters flyout that opens:

• Message ID: The globally unique identifier of the message.

• Sender address

• Recipient address

• Subject

• Time received: Select one of the following values:

  • Last 24 hours
  • Last 7 days (default)
  • Last 14 days
  • Last 30 days (default)
  • Custom: Enter a Start time and End time (date).

• Expires: Filter messages by when they expire from quarantine. Select one of the following values:

  • Today
  • Next 2 days
  • Next 7 days
  • Custom: Enter a Start time and End time (date).

• Quarantine reason: Select one or more of the following values:

  • Transport rule (mail flow rule)
  • Bulk
  • Spam
  • Malware: Anti-malware policies in EOP or Safe Attachments policies in Defender for Office 365. The Policy Type value indicates which feature was used.
  • Phishing: The spam filter verdict was Phishing or anti-phishing protection quarantined the message (spoof settings or impersonation protection).
  • High confidence phishing

• Blocked sender: One of the following values:

  • Don't show blocked senders (default)
  • Show all senders

  Tip

  If a sender is blocked and Don't show blocked senders is selected, messages from those senders are shown on the Quarantine page and are included in quarantine notifications when the Sender address override reason value is None. This behavior occurs because the messages were blocked due to reasons other than sender address overrides.

• Release status: Any of the following values:

  • Needs review
  • Approved
  • Denied
  • Release requested
  • Released

• Policy Type: Filter messages by what type of protection policy quarantined the message. Select one or more of the following values:

  • Anti-malware policy
  • Safe Attachments policy
  • Anti-phishing policy
  • Anti-spam policy
  • Transport rule (mail flow rule)

  The Policy type and Quarantine reason values are interrelated. For example, Bulk is always associated with an Anti-spam policy, never with an Anti-malware policy.

When you're finished on the Filters flyout, select Apply. To clear the filters, select Clear filters.

Use the Search box and a corresponding value to find specific messages. Wildcards aren't supported. You can search by the following values:

• Sender email address
• Subject. Use the entire subject of the message. The search isn't case-sensitive.

After you've entered the search criteria, press the enter ENTER key to filter the results.

After you find a specific quarantined message, select the message to view details about it and to take action on it (for example, view, release, download, or delete the message).

View quarantined message details

1. In the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Review > Quarantine > Email tab. Or, to go directly to the Email tab on the Quarantine page, use https://security.microsoft.com/quarantine?viewid=Email.

2. On the Email tab, select the quarantined message by clicking anywhere in the row other than the check box.

In the details flyout that opens, the following information is available:

• Quarantine details section:
  • Received: The date/time when the message was received.
  • Expires: The date/time when the message is automatically and permanently deleted from quarantine.
  • Subject
  • Quarantine reason: Shows if a message has been identified as Spam, Bulk, Phish, matched a mail flow rule (Transport rule), or was identified as containing Malware.
  • Policy type
  • Recipient count
  • Recipients: If the message contains multiple recipients, you might need to select > Preview message or > View message header to see the complete list of recipients.
  • Sender override reason
  • Released by:
    • If the user released their message, the user's email address is shown.
    • If the message was released by an admin, the value Admin is shown.
    • if the release is carried out by the system, the value System is shown
    • if the release is not carried out by user, Admin, or system, it defaults to Admin.
• Email details section:
  • Sender address
  • Time received
  • Network message ID
  • Recipients

To take action on the message, see the next section.

Take action on quarantined email

1. In the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Review > Quarantine > Email tab. Or, to go directly to the Email tab on the Quarantine page, use https://security.microsoft.com/quarantine?viewid=Email.

2. On the Email tab, select the quarantined email message by using either of the following methods:

   • Select the message from the list by selecting the check box next to the first column. The available actions are no longer grayed out.

     

   • Select the message from the list by clicking anywhere in the row other than the check box. The available actions are in the details flyout that opens.

     

   Using either method to select the message, some actions are available under More or More options.

After you select the quarantined message, the available actions are described in the following subsections.

Release quarantined email

This action isn't available for email messages that have already been released (the Release status value is Released).

If you don't release or remove a message, it's automatically deleted from quarantine after the date shown in the Expires column.

After you select the message, use either of the following methods to release it (deliver it to your mailbox):

• On the Email tab: Select Release.
• In the details flyout of the selected message: Select Release email.

In the Release message to your Inbox flyout that opens, select Report message as having no threats as appropriate, and then select Release message.

When you're finished on the Release message to your Inbox flyout, select Release message.

In the Messages released to your Inbox flyout that opens, select Done.

Back on the Email tab, the Release status value of the message is Released.

The message is delivered to your Inbox (or some other folder, depending on any Inbox rules in your mailbox).

Request the release of quarantined email

This action isn't available for email messages where you already requested release (the Release status value is Released requested).

If you don't release or remove a message, it's automatically deleted from quarantine after the date shown in the Expires column.

After you select the message, use either of the following methods to request its release:

• On the Email tab: Select Request release.
• In the details flyout of the selected message: Select More options > Request release.

In the Request release flyout that opens, review the information, select Request release. In the Release requested flyout that opens, select Done.

Back on the Quarantine page, the Release status value of the message is Release requested. An admin will review your request and approve it or deny it.

Delete email from quarantine

When you delete an email message from quarantine, the message is removed and isn't sent to the original recipients.

If you don't release or remove a message, it's automatically deleted from quarantine after the date shown in the Expires column.

After you select the message, use either of the following methods to remove it:

• On the Email tab: Select Delete messages.
• In the details flyout of the selected message: Select More options > Delete from quarantine.

In the Delete (n) messages from quarantine flyout that opens, use one of the following methods to delete the message:

• Select Permanently delete the message from quarantine and then select Delete: The message is permanently deleted and isn't recoverable.
• Select Delete only: The message is deleted, but is potentially recoverable.

After you select Delete on the Delete (n) messages from quarantine flyout, you return to the Email tab where the message is no longer listed.

Preview email from quarantine

After you select the message, use either of the following methods to preview it:

• On the Email tab: Select Preview message.
• In the details flyout of the selected message: Select More options > Preview message.

In the flyout that opens, choose one of the following tabs:

• Source: Shows the HTML version of the message body with all links disabled.
• Plain text: Shows the message body in plain text.

View email message headers

After you select the message, use either of the following methods to view the message headers:

• On the Email tab: Select More > View message headers.
• In the details flyout of the selected message: Select More options > View message headers.

In the Message header flyout that opens, the message header (all header fields) is shown.

Use Copy message header to copy the message header to the clipboard.

Select the Microsoft Message Header Analyzer link to analyze the header fields and values in depth. Paste the message header into the Insert the message header you would like to analyze section (CTRL+V or right-click and choose Paste), and then select Analyze headers.

Allow email senders from quarantine

The Allow sender action adds the message sender to the Safe Senders list in your mailbox. For more information about allowing senders, see Add recipients of my email messages to the Safe Senders List.

After you select the message, use either of the following methods to add the message sender to the Safe Senders list in your mailbox:

• On the Email tab: Select More > Allow sender.
• In the details flyout of the selected message: Select More options > Allow sender.

The flyout that opens indicates when the sender was successfully added to your Safe Senders list. Select Done.

Block email senders from quarantine

The Block sender action adds the message sender to the Blocked Senders list in your mailbox. For more information about blocking senders, see Block a mail sender.

After you select the message, use either of the following methods to add the message sender to the Blocked Senders list in your mailbox:

• On the Email tab: Select More > Block sender.
• In the details flyout of the selected message: Select More options > Block sender.

In the Block sender flyout that opens, review the information about the sender, and then select Block.

Remove senders from your Blocked Senders list from quarantine

The Remove sender from user block list is available only if the sender of the quarantined message is already in your Block Senders list.

After you select the message, use either of the following methods to remove the sender from your Block Senders list:

• On the Email tab: Select More > Remove sender from user block list.
• In the details flyout of the selected message: Select More options > Remove sender from user block list.

The flyout that opens indicates when the sender was successfully removed from your Blocked Senders list. Select Done.

Take action on multiple quarantined email messages

When you select multiple quarantined messages on the Email tab by selecting the check boxes next to the first column, the following bulk actions are available on the Email tab (depending on the Release status values of the messages that you selected):

• Release quarantined email
• Request the release of quarantined email
• Delete email from quarantine

Manage quarantined messages in Microsoft Teams

When a potentially malicious chat message is detected in Microsoft Teams, zero-hour auto purge (ZAP) removes the message and quarantines it. Users can now view and manage these quarantined Teams messages in the Microsoft Defender portal. Quarantine notifications aren't supported for quarantined Teams messages.

View your quarantined messages in Microsoft Teams

In the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Review > Quarantine > Teams messages tab. Or, to go directly to the Teams messages tab on the Quarantine page, use https://security.microsoft.com/quarantine?viewid=Teams.

You can sort the entries by clicking on an available column header. Select Customize columns to change the columns that are shown. The default columns are:

• Teams message text: Contains the subject for the teams message.
• Date quarantined: Showed when the message was quarantined.
• Status: Shows whether the message is already reviewed and released or needs review.
• Sender: The person who sent the message that was quarantined.
• Quarantine reason: Available options are High confidence phish and Malware.
• Expires: Indicates the time after which the message is removed from quarantine. By default, this value is 30 days.

To filter the entries, select Filter. The following filters are available in the Filters flyout that opens:

• Sender address
• Time received:
  • Last 24 hours
  • Last 7 days
  • Last 14 days
  • Last 30 days (default)
  • Custom: Enter a Start time and End time (date).
• Expires in:
  • Custom (default): Enter a Start time and End time (date).
  • Today
  • Next 2 days
  • Next 7 days
• Quarantine reason: Available values are Malware and High confidence phishing.
• Status: Select Needs review and Released.

When you're finished in the Filters flyout, select Apply. To clear the filters, select Clear filters.

Use the Search box and a corresponding value to find specific Teams messages. Wildcards aren't supported.

After you find a specific quarantined Teams message, select the message to view details about it and to take action on it (for example, view, release, download, or delete the message).

View quarantined message details in Microsoft Teams

On the Teams messages tab, select the quarantined message by clicking anywhere in the row other than the check box.

In the details flyout that opens, the following information is available:

• Quarantine details section: Includes quarantine reason, expiry date, quarantine policy type, and other information.
  • Expires
  • Time received
  • Quarantine reason
  • Release status
  • Policy type
• Message details section: Includes date and time of the message sent, the sender address, Teams message ID, and the list of recipients.
  • Sender address
  • Time received
  • Recipients
  • Teams message ID

To take action on the message, see the next section.

Take action on quarantined messages in Microsoft Teams

On the Teams messages tab, select the quarantined message by selecting the check box next to the first column. The following options are available:

• Request release: You can request to release the message from quarantine. Your organization's admin needs to approve the release.
• Delete: You can request to delete the message from the list of quarantined messages.
• Preview message: You can view the details of the message you selected.

If you don't release or remove a message, it's automatically deleted from quarantine after the date shown in the Expires column.