This guide shows you how to find and manage emails that Microsoft 365 (formerly Office 365) has quarantined as suspicious. Quarantine is a safety net that holds messages flagged as spam, phishing, or containing malware, so they don’t reach your inbox. You’ll learn the quickest ways to review, release, or delete these messages, and how to adjust your settings to reduce false positives.
Ingredients
- 1 Microsoft 365 work or school account with access to the Microsoft 365 Defender portal
- 1 web browser (Edge, Chrome, Firefox, or Safari)
- Your login credentials (email and password, plus multi-factor authentication if enabled)
- Optional: Admin permissions if you need to change quarantine policies for your organization
Instructions
- Open the Microsoft 365 Defender portal. In your web browser, go to
https://security.microsoft.com. Sign in with your work or school account. If you don’t have access to this portal, contact your IT admin. - Navigate to the Quarantine page. In the left-hand menu, click Email & collaboration, then select Review, and finally click Quarantine. This opens the list of quarantined messages.
- Filter the list (optional). Use the filters at the top to narrow down results by date, sender, recipient, or quarantine reason (e.g., spam, phishing, malware). You can also search for a specific email by subject or sender address.
- Review a quarantined email. Click on any message in the list to see its details, including the sender, subject, and why it was quarantined. You can view the message headers and, if allowed by your admin, preview the message body.
- Take action on the message. After reviewing, you have several options:
- Release: Deliver the email to your inbox (or the original recipient’s inbox). You can also choose to release and report it as not junk.
- Delete: Permanently remove the message from quarantine.
- Download: Save the message as a file (if your admin has enabled this).
- Confirm your action. If you choose to release, a confirmation dialog will appear. Click Release (or Release and report) to proceed. The email will then be delivered to the intended recipient’s mailbox.
- For end users (if enabled): If your organization allows user quarantine notifications, you might receive a periodic email digest listing quarantined messages. You can click the link in that email to go directly to the quarantine portal and review your messages there.
Tips
- Check quarantine regularly: Quarantined messages are automatically deleted after a set period (default is 30 days for spam, but your admin may change this). Check at least once a week to avoid losing important emails.
- Use the “Report as not junk� option: When you release a message that was incorrectly quarantined, use the “Report as not junk� option. This helps Microsoft improve its filtering and reduces future false positives.
- Don’t release suspicious messages blindly: If a message is quarantined as phishing or malware, it’s often best to delete it. Only release messages you are absolutely sure are legitimate.
- Admin tip: If you are an admin, you can create custom quarantine policies to specify what actions users can take (e.g., allow users to release their own messages). This can reduce IT helpdesk tickets.
Serving Suggestions
This guide is best used when you’re expecting an important email that hasn’t arrived, or when you want to ensure your inbox isn’t missing legitimate messages. It’s also useful for periodic housekeeping—like a weekly review of your quarantined items to keep your email environment clean and secure.
Variations
- Using the Microsoft 365 admin center (legacy): Some organizations still use the older Exchange admin center. You can access quarantine via
https://admin.exchange.microsoft.com> Mail flow > Quarantine. - Using PowerShell: For advanced users, you can use Exchange Online PowerShell to view and manage quarantine. For example,
Get-QuarantineMessagelists messages, andRelease-QuarantineMessagereleases them. - End-user quarantine notifications: If your admin has enabled end-user spam notifications, you may receive a daily or weekly email with a list of quarantined messages. You can click the “Review� button in that email to go directly to the portal.
Storage and Reheating
Quarantined emails are stored on Microsoft’s servers for a limited time—typically 30 days for spam and phishing, and 15 days for malware (though admins can adjust these). After that period, they are automatically deleted and cannot be recovered. If you need to keep a copy of a quarantined email, you must release it to your mailbox or download it before the retention period expires. There’s no “reheating� here—once deleted, it’s gone.
Frequently Asked Questions
Why can’t I see the Quarantine option in the Defender portal? You likely don’t have the required permissions. Your organization’s admin must assign you the “Quarantine� role (or be a member of a role group that includes it). Contact your IT administrator to request access.
How do I release a quarantined email to another user? As an admin, you can release a message to the original recipient or to a different user. In the quarantine details, select “Release� and then choose “Release to specific users� to enter the email address of the intended recipient.
What if I accidentally release a phishing email? If you release a message that turns out to be malicious, report it immediately to your IT department. They can take further action, such as blocking the sender and removing the message from other mailboxes.
Can I change how long emails stay in quarantine? Yes, but only an admin can change the retention period. In the Defender portal, go to Policies > Threat policies > Quarantine policies to modify the retention settings for different quarantine types.
Why did a legitimate email go to quarantine? Microsoft’s filters sometimes make mistakes (false positives). This can happen if the email contains certain links or attachments, or if the sender’s domain has a poor reputation. You can reduce this by adding the sender to your safe senders list, but that only works for your own mailbox, not the whole organization.
Is there a way to get a daily summary of quarantined emails? Yes, if your admin has enabled end-user spam notifications, you’ll receive a daily or weekly digest. If you don’t get them, ask your admin to enable this feature in the Defender portal under Policies > Threat policies > End-user spam notifications.
Related
- The Smoking Cuban: Smoky Pulled Pork Sandwich
- Super Peking Duck Paragon Menu Recipe
- The Smoking Cigar: A Savory Stuffed Bread Roll
More recipes to cook
Safety notes: safe minimum internal temperatures from USDA FSIS; raw and undercooked fish guidance from the U.S. FDA. Food safety notes
Spotted an error? Tell us and we will correct it (corrections policy).