What is a Quarantined email
You're probably familiar with Microsoft Outlook's Junk folders for email. By default, phishing, spam and bulk email messages are directed to your Junk Email folder, which is a good reason to review this folder daily. Sometimes junk mail goes into a Quarantine state because the message is potentially dangerous. These types of emails are "Quarantined" as a precaution.
The quarantining feature is now active and will hold potentially dangerous messages. This feature will automatically quarantine a message if any attachment or link is determined to possibly contain malware. Malware is any software intentionally designed to cause damage to a computer. Like Junk mail, after review, you can choose to move Quarantined messages to your inbox (release it) or delete it (block sender).
How this impacts Staff
If email messages addressed to you were sent to Quarantine, you will receive an email notification from Quarantine.messaging.microsoft.com with the subject line "Spam Notification" (like in the screen grab below) in your mailbox. The email provides you with a list of the messages addressed to you that are stored on the Quarantine page within the M365 Security & Compliance Center. You can look at the message subject headers to determine their content and decide what actions you want to apply to the messages. If you don’t know the sender, then you can block the sender using the buttons within the notification. If you know the sender and have verbally verified, they did send the email with attachment or link you can release it to your inbox. After thirty (30) days the quarantined messages will expire and not be accessible.
How do I delete my messages in the Quarantine?
There is no need to delete your messages in the Quarantine. If you do not release a message from the Quarantine, it will automatically be deleted after 30 days. If you look at the messages in your Quarantine location determine that all of them are spam, you do not need to do anything. The messages will automatically be deleted from the Quarantine.
View your quarantined messages
To open the Quarantine page, go to https://security.microsoft.com/quarantine
View quarantined message details
When you select an email message in the list, the following message details appear in the Details fly out pane:
- Message ID: The globally unique identifier for the message.
- Received: The date/time when the message was received.
- Sender: The send name and email address of the quarantined message.
- Subject: The subject line text of the quarantined message.
- Date: The date and time in Universal Time Coordinated (UTC) that the message was quarantined. Note: UTC is 7 hours AHEAD of Pacific Standard Time (PST)
- Quarantine reason: Shows if a message has been identified as Spam, Bulk or Phish.
- Recipients: If the message contains multiple recipients, you need to click Preview message or View message header to see the complete list of recipients.
- Expires: The date/time when the message will be automatically and permanently deleted from quarantine.
- Released to: All email addresses (if any) to which the message has been released.
- Not yet released to: All email addresses (if any) to which the message has not yet been released.
Take action on quarantined email
After you select a message, you have options for what to do with the messages in the Details fly out pane:
The notification contains the following information for each quarantined message:
- Block Sender: If you don’t know the sender and it could be “spam” you can add the sender to the Blocked Senders list on your mailbox. For more information, see Block a mail sender
- Release: For messages that you have verbally confirmed with the sender, you can release the message to your Inbox.
- Review: where you can (depending on why the message was quarantined) view, release, delete or report your quarantined messages.
When you're finished, click Close.
If you don't release or remove the message, it will be deleted after the thirty (30) day quarantine retention period expires.
Take action on multiple quarantined email messages
When you select multiple quarantined messages in the list (up to 100), the Bulk actions fly out pane appears where you can take the following actions:
- Release messages: The options are the same as when you release a single message, except you can't select Release messages to specific recipients; you can only select Release message to all recipients or Release messages to other people.
- Delete messages: After you click Yes in the warning that appears, the message are immediately deleted without being sent to the original recipients.
When you're finished, click Close.