What is Quarantine?

Quarantine acts as a filter to capture and hold potentially dangerous and unwanted emails before they get to a users mailbox. Sometimes this can include false positives, such as newsletters or One-Time Passcodes.

Quarantine is configured in such a way that regular uses can view & release any emails caught in quarantine that may have been caught as a false positive.

Below you'll find instructions on how this works.

Quick Links:

Quarantine - https://security.microsoft.com/quarantine

TABLE OF CONTENTS

• Daily Digest / Navigating to Quarantine
• Release Quarantined Email
• Request the Release of Quarantined Email
• Preview Email from Quarantine

Daily Digest / Navigating to Quarantine

If you have emails in your quarantine, you'll receive a "Daily Digest" from Microsoft ([email protected]) which will look similar to the below. 

This will give you a summary of the emails currently in your quarantine, as well as quick action buttons to Review, Release or Block Sender.

If you want to bypass the Daily Digest, you can go directly to your quarantine by visiting this website (https://security.microsoft.com/quarantine)

Release Quarantined Email

These instructions are relevant to users looking at quarantine via (https://security.microsoft.com/quarantine)

This action isn't available for email messages where you already requested release (the Release status value is Released requested).

If you don't release or remove a message, it's automatically deleted from quarantine after the date shown in the Expires column.

After you select the message, use either of the following methods to release it (deliver it to your mailbox):

• On the Email tab: Select Release.
• In the details flyout of the selected message: Select Release email.

In the Release message to your Inbox flyout that opens, select Report message as having no threats as appropriate, and then select Release message.

When you're finished on the Release message to your Inbox flyout, select Release message.

In the Messages released to your Inbox flyout that opens, select Done.

Back on the Email tab, the Release status value of the message is Released.

The message is delivered to your Inbox (or some other folder, depending on any Inbox rules in your mailbox).

Request the Release of Quarantined Email

These instructions are relevant to emails that are classified as "High Confidence Phish"

This action isn't available for email messages where you already requested release (the Release status value is Released requested).

If you don't release or remove a message, it's automatically deleted from quarantine after the date shown in the Expires column.

After you select the message, use either of the following methods to request its release:

• On the Email tab: Select Request release.
• In the details flyout of the selected message: Select More options > Request release.

In the Request release flyout that opens, review the information, select Request release. In the Release requested flyout that opens, select Done.

Back on the Quarantine page, the Release status value of the message is Release requested. An admin will review your request and approve it or deny it.

Preview Email from Quarantine

After you select the message, use either of the following methods to preview it:

• On the Email tab: Select Preview message.
• In the details flyout of the selected message: Select More options > Preview message.

In the flyout that opens, choose one of the following tabs:

• Source: Shows the HTML version of the message body with all links disabled.
• Plain text: Shows the message body in plain text.