What is a Quarantined email?
You're probably familiar with Microsoft Outlook's Junk folders for email. By default, phishing, spam, and bulk email messages are directed to your Junk Email folder, which is a good reason to review this folder daily. Sometimes junk mail enters Quarantine because the message is potentially dangerous. These types of emails are "Quarantined" as a precaution.
It is important to note that these emails were quarantined for a reason, and you should proceed with utmost caution when releasing quarantined emails. Only release emails from quarantine that you know to be safe. If you do not release a message from the Quarantine, it will automatically be deleted after 30 days.
Video: Managing the user quarantine in Microsoft Defender for Office 365
To open the Quarantine page, go to https://security.microsoft.com/quarantine
What to Expect:
If email messages addressed to you were sent to Quarantine, you will receive an email notification from Quarantine@messaging.microsoft.com or Quarantine@Sunyempire.edu with the subject line "Microsoft 365 security: You have messages in quarantine” or "You have messages in your SUNY Empire email quarantine" in your mailbox. The email provides you with a list of the messages addressed to you that are stored on the Quarantine page within the M365 Security & Compliance Center. You can look at the message subject headers to determine their content and decide what actions you want to apply to the messages. If you don’t know the sender, you can block the sender using the buttons within the notification. If you know the sender and have verbally verified they did send the email with an attachment or link, you can release it to your inbox. After thirty (30) days, the quarantined messages will expire and be deleted.
How do I delete my messages in the Quarantine?
There is no need to delete your messages in the Quarantine. If you do not release a message from the Quarantine, it will automatically be deleted after 30 days. If you look at the messages in your Quarantine location and determine that all of them are unwanted, you do not need to do anything. The messages will automatically be deleted from the Quarantine.
View your quarantined messages.
To open the Quarantine page, go to https://security.microsoft.com/quarantine
View quarantined message details.
When you select an email message in the list, the following message details appear in the details fly-out pane:
-
Message ID: The globally unique identifier for the message.
-
Received: The date/time when the message was received.
-
Sender: The sender's name and email address of the quarantined message.
-
Subject: The subject line text of the quarantined message.
-
Date: The date and time in Universal Time Coordinated (UTC) that the message was quarantined.
-
Quarantine reason: Shows if a message has been identified as Spam, Bulk , or Phish.
-
Recipients: If the message contains multiple recipients, click Preview message or View message header to see the complete list of recipients.
-
Expires: The date/time when the message will be automatically and permanently deleted from quarantine.
Take action on quarantined emails.
After you select a message, you have options for what to do with the messages in the Details fly-out pane:
The notification contains the following information for each quarantined message:
-
Block Sender: If you don’t know the sender and it could be “spam” you can add the sender to the Blocked Senders list on your mailbox. For more information, see Block a mail sender.
-
Release / Request release: For messages that you have verbally confirmed with the sender, you can release the message to your Inbox.
-
Review: where you can (depending on why the message was quarantined) view, release, delete or report your quarantined messages.
When you're finished, click Close.
If you don't release or remove the message, it will be deleted after the thirty (30) day quarantine retention period expires.
Take action on multiple quarantined email messages
When you select multiple quarantined messages in the list (up to 100), the Bulk actions fly-out pane appears, where you can take the following actions:
When you're finished, click Close.
Please contact the IT Service Desk with any questions or concerns.