Microsoft Defender Quarantine
Category: Office 365 OIT and Partner Supported Productivity and Business Audience: Faculty Researchers Staff Students
Microsoft Defender Quarantine is a feature integrated with Outlook to protect the university community from harmful emails and spam. It automatically holds suspicious emails in quarantine until reviewed and a decision is made if the messages should be delivered to their inbox or deleted. All faculty, staff and students have Microsoft Defender Quarantine enabled on their university Outlook Email account.
On this page:
- About Microsoft Defender Quarantine
- How to Check Quarantined Emails
- How to Release or Delete Emails
- Create a Mailbox Rule to Move Quarantine Email Notifications
- Customize Your Quarantine Navigation
- Additional Resources and Links
- Microsoft Quarantine YouTube Video
- Visit the FAQ Section to Learn How To Manage Your Safe or Blocked Senders List
About Microsoft Defender Quarantine
Microsoft Defender Quarantine provides an extra layer of protection from phishing and spam for the university. The feature empowers end users to release messages they previously would not have seen. This new feature enhances email security while making it easier for the university community to monitor their emails and save time by releasing legitimate emails on their own. You will have control over your own safe senders and blocked senders lists that can be edited at any time.
You will receive quarantine notification emails from quarantine@messaging.microsoft.com when there are messages for review.
How to Check Quarantined Emails
- You can also go to https://security.microsoft.com/quarantine and login with your university email address and password. Note: You can release or block emails directly from a quarantine notification email message.
- Review the list of emails that have been quarantined.
- Click Preview to see the content of the email.
- Click Release to move the email to your mailbox.
- Click Delete to remove the message from your quarantine.
Tip: Consider bookmarking https://security.microsoft.com/quarantine to easily check your Quarantine in the future.
The deleted items folder retention period is 30 days. After that, messages are automatically removed from the folder. Items that have been automatically removed from the Deleted Items folder are retained for 30 days before being permanently deleted.
Training Resources
Getting Started
Microsoft Defender Quarantine - Release and Delete Emails
Follow this tutorial to learn how to release or delete emails from Microsoft Defender Quarantine.
*Note: It is important that you fully verify an email is safe before releasing it. If you are unsure about an email, submit a ticket to the OIT Service Desk to have the email reviewed before releasing it to your inbox.
Step 1
Go to https://security.microsoft.com/quarantine and login with your university email address and password.
Note: You can also release or block emails directly from a Quarantine notification email message.
Step 2
Review list of emails that have been Quarantined. Click the Preview button to see the contents of an email.
Step 3
The Preview panel will show the contents of an email so you can verify if it's legitimate, spam or phishing. When finished, click the X in the top right corner to close the panel and return to Quarantine.
Step 4
Click the checkbox next to an email you'd like to release and click the Release checkmark icon.
Alternatively, if you know it's unsafe or spam, you can click the Delete Messages button. You do not have to take action on those emails, however, as anything left in Quarantine will automatically be deleted after 30 days.
If you click on the email, it will show more information about the email and the sender. If you determine it's safe, click Release email.
Step 5
Confirm that you'd like to Release message to your mailbox. You also have the option to report the message as Safe which may improve the Microsoft Defender AI to not Quarantine these messages in the future.
Step 6
The email's Release Status will change to Released. Select the email and click the Delete icon to remove the message from your Quarantine list.
Note: The Deleted Items folder retention period is 30 days. After that, messages are automatically removed from the folder. Items that have been automatically removed from the Deleted Items folder are retained for 30 days before being permanently deleted.
Create a Mailbox Rule to Move Quarantine Email Notifications
There is not an opt-out process for the Quarantine notifications, but you can create a rule in Outlook to move the emails to another folder if you do not want to receive notifications in your focused in-box. See the steps below for creating a rule:
Step 1
Log in to your Outlook Web Account
Click on the Settings icon in the top right corner of the screen.
Step 2
Select Mail, then Rules. Click Add New Rule.
Add a name for the rule, use the Form address quarantine@messaging.microsoft.com, and then select the folder you want to move the messages to so that you can review them at a later time.
Customize Your Navigation
You can customize the left-hand navigation in Microsoft Defender so that the inaccessible options are not displayed.
1) Scroll to the bottom of the left-hand navigation pane. Click on Customize navigation.
2) In the Customization menu, uncheck all the boxes except for Review. This is the only navigation option needed to review emails in quarantine.
Help and Support
If you have any questions about Microsoft Defender Quarantine, please contact the OIT Service Desk.