Reviewing & Releasing Emails from Quarantine

Microsoft Defender Quarantine is a feature that is integrated with Outlook to protect users from harmful emails and spam. It automatically holds suspicious emails in quarantine until the user can review them and decide whether to allow them to be delivered to their inbox or to delete them.

If one or several of your emails have been quarantined, you will receive an email from quarantine@messaging.microsoft.com with the subject line 'Microsoft 365 security: You have messages in quarantine.'

The email will let you preview the sender, subject, and date the email was sent. If you are unsure about the legitimacy of the email in quarantine you can 'Review Message', or if you are familiar with the sender and were expecting the email you can 'Release' it.

Reviewing the Message

To learn more about the email in quarantine, click the 'Review Message' button in the email or go to security.microsoft.com/quarantine and login with your SSCC username and password. Once logged in to Microsoft Quarantine, you will see a list of all the emails you have quarantined.

Click on any of your quarantined emails that are marked as 'Needs review', and a window will pop-up with more details on when it was received, the subject, the reason for quarantine, the policy type, sender address, and the recipients.

If you are still not sure if the email is legitimate, you can preview the message. To do this select the 3 dots near the top of the window, then select 'Preview message'.

The preview will open in a window above the current window and will display the email the same way it would be displayed in your inbox. After previewing you can click the X in the upper right corner to return to the previous window.

Releasing an Email to Your Inbox

If you determine that the email is legitimate and you would like it released to your inbox, select the 'Release email' button near the top of the window.

You can now navigate back to your regular email inbox and the email will be at the top of your inbox.

Deleting a Malicious Email from the Quarantine

If you have determined the email to be malicious, you will need to delete the email from quarantine. To do this select the 3 dots near the top of the window, then select 'Delete from quarantine'.

Allowing a Sender so Future Emails won't get Quarantined

If you often get emails from an address that was quarantined and anticipate receiving more emails from them in the future, you can select 'Allow sender'. To do this select the 3 dots near the top of the window, then select 'Allow sender'.