Accessing quarantined messages

To view your messages quarantined by Microsoft 365 Defender, please navigate to: https://security.microsoft.com/quarantine.

You will also receive an email of quarantine reports when there are any emails in the Quarnatine folder. 

Alternatively, you can open the 365 Defender portal by navigating to: https://security.microsoft.com and then navigate to ‘Email & collaboration’ -> ‘Review’ -> ‘Quarantine’.

Once you find a quarantined message, click on it either by checking the box next to the message or clicking anywhere in the row (excluding the checkbox) to view details and take action.

In the flyout details window that opens, you will find the following information:

From here you are able to see the actions available to you by clicking on the 3 dots icon as shown below:

Release quarantined email

If you are unsure about any of the emails in your quarantine it is advised that you preview the message before deciding to release by selecting ‘Preview message’.

If you still have any doubt on the legitimacy of the email it is advised that you do not release it.

1.       Select the message and choose one of the following methods to release it:
   
1. On the Email tab: check the checkbox to the left of the email and select ‘Release’.
   
2. In the details flyout: Select ‘Release email’.
   
2. In the ‘Release message to your Inbox’ flyout, select ‘Report message as having no threats’ if appropriate.
   
3. Click ‘Release message’ to deliver it to your Inbox.
   
4. In the ‘Messages released to your Inbox’ flyout, select ‘Done 

Request the release of quarantined email

1.  Select the message and choose one of the following methods to request its release:
   
1. On the Email tab: check the checkbox to the left of the email and select ‘Request release’.
   
2.  In the details flyout: Select 3 dots and select ‘Request release’.
   
2. In the ‘Request release’ flyout, review the information and select ‘Request release’.
   
3. In the ‘Release requested’ flyout, select ‘Done’.
   

On The main quarantine page, the release status will change to ‘Release requested’. An admin will review your request and approve it or deny it.

Delete email from quarantine

 When you delete an email message from quarantine, the message is removed and isn't sent to the original recipient(s).

1.  After you select the message, use either of the following methods to remove it:
   
1. On the Email tab: check the checkbox to the left of the email and select ‘Delete messages’.
   
2. In the details flyout of the selected message: Select the 3 dots and select ‘Delete from quarantine’.
   
2. In the Delete (n) messages from quarantine flyout that opens, use one of the following methods to delete the message:
   
1. Select Permanently delete the message from quarantine and then select Delete: The message is permanently deleted and isn't recoverable.
   
2. Select Delete only: The message is deleted but is potentially recoverable. After you select Delete on the Delete (n) messages from quarantine flyout, you return to the Email tab where the message is no longer listed.