Managing Email Quarantine

The University of Redlands email system runs on the Microsoft 365 cloud and utilizes several protection technologies that filter out and quarantine malicious email that are considered Spam, Phishing, or contain malware. Information Technology Services at the University of Redlands attempts to balance security with usability in configuring these protection systems. However, emails that are not malicious or harmful may be quarantined. To improve email delivery, ITS has enabled end users to review their quarantined emails and release any false positives. It is important to note that these emails were quarantined for a reason, and you should proceed with utmost caution when releasing quarantined emails. Messages in the quarantine can be accessed in one of two ways:

End-User Spam Notifications

UoR email users will receive a daily email from quarantine@messaging.microsoft.com, listing the emails that have been determined to be SPAM, BULK or PHISHING. The end user notification contains the following information for each message:

Sender: The send name and email address of the quarantined message.
Subject: The subject line text of the quarantined message.
Date: The date and time (in UTC) that the message was quarantined.
Block Sender: Click this link to add the sender to your Blocked Senders list. For more information, see Block a mail sender.
Release: You can release the message here without going to Quarantine Page on the Microsoft 365 Defender site. To ensure the sender is not quarantined in the future you can add the user to your safe sender list once released from quarantine.
Review: Click this link to go to Quarantine in the Microsoft 365 Defender Site, where you can (depending on why the message was quarantined) view, release, delete or report your quarantined messages.

View Quarantined Messages in the Microsoft 365 Defender Site

UoR email users can also visit, https://security.microsoft.com/quarantine at any time and view the quarantined emails. Users can also click on the View Quarantine button on the Outlook Toolbar to open the quarantine page.

On the Quarantine page, you can sort the results by clicking on an available column header. Click Customize columns to change the columns that are shown. The default values are marked with an asterisk (^*):
- Time received^*
- Subject^*
- Sender^*
- Quarantine reason^*
- Release status^*
- Policy type^*
- Expires^*
- Recipient
- Message ID
- Policy name
- Message size
- Mail direction
When you're finished, click Apply.
To filter the results, click Filter. The following filters are available in the Filters flyout that appears:
- Message ID: The globally unique identifier of the message.
- Sender address
- Recipient address
- Subject
- Time received: Enter a Start time and End time (date).
- Expires: Filter messages by when they will expire from quarantine:
  - Today
  - Next 2 days
  - Next 7 days
  - Custom: Enter a Start time and End time (date).
- Quarantine reason:
  - Bulk
  - Spam
  - Phishing: The spam filter verdict was Phishing or anti-phishing protection quarantined the message.
  - High confidence phishing
- Release status: Any of the following values:
  - Needs review
  - Approved
  - Denied
  - Release requested
  - Released
- Policy Type: Filter messages by policy type:
  - Anti-malware policy
  - Safe Attachments policy
  - Anti-phishing policy
  - Anti-spam policy
When you're finished, click Apply. To clear the filters, click Clear filters.
Use Search box and a corresponding value to find specific messages. Wildcards aren't supported. You can search by the following values:
- Message ID
- Sender email address
- Recipient email address
- Subject. Use the entire subject of the message. The search is not case-sensitive.
- Policy name. Use the entire policy name. The search is not case-sensitive.
After you've entered the search criteria, press ENTER to filter the results.

After you find a specific quarantined message, select the message to view details about it, and to take action on it (for example, view, release, download, or delete the message).

Take action on quarantined email

After you select a quarantined message from the list, the following actions are available in the details flyout:

Available actions in the details flyout of a quarantined message.

Release email^*: Delivers the message to your Inbox.
View message headers: Choose this link to see the message header text. The Message header flyout appears with the following links:

The following actions are available after you click More actions icon. More actions:

Preview message: In the flyout that appears, choose one of the following tabs:
Remove from quarantine: After you click Yes in the warning that appears, the message is immediately deleted without being sent to the original recipients.
Block sender: Add the sender to the Blocked Senders list in your mailbox. For more information, see Block a mail sender.

If you don't release or remove the message, it will be deleted after the default quarantine retention period expires (as shown in the Expires column).

Note

On a mobile device, the description text isn't available on the action icons.

Details of a quarantined message with available actions highlighted.

The icons in order and their corresponding descriptions are summarized in the following table:

TABLE 2 Icon Description Release email icon.

Release email View message headers icon.

View message headers Preview message icon.

Preview message Remove from quarantine icon.

Remove from quarantine Block sender icon.

Block sender

Prevent an email from going to quarantine

To prevent an email from going to quarantine, see this knowledge base article: Managing Safe Senders