Quarantined Email Summary

Once a day staff will receive an emailed summary of messages in their quarantine inbox.

Staff are not notified for spam/junk emails. These are silently routed to the ‘junk’ email folder in Outlook.

Staff are notified if an email is quarantined for:

• Low confidence of spoofing
• Low confidence of phishing

Staff are NOT notified if an email is quarantined for:

• Internal Domain Impersonation
• Internal User Impersonation
• High confidence of spoofing
• High confidence of phishing
• Malware

Notifications will include

• Sender: The send name and email address of the quarantined message.
• Subject: The subject line text of the quarantined message.
• Date: The date and time (in UTC) that the message was quarantined.

From the time it was quarantined, staff will have 30 days to take action on the quarantine email. After 30 days, the email is deleted and will be irrecoverable.

The following actions are available in the quarantine notification for messages that were quarantined.

• Block Sender: Click this link to add the sender to the Blocked Senders list on your mailbox. For more information, see Block a mail sender.
• Request Release: Click this link to send a request to IT to review and release the email.
• Delete: You can delete the message here without going to Quarantine in the Microsoft 365 Defender portal.
• Review: Click this link to go to Quarantine in the Microsoft 365 Defender portal, where you can (depending on why the message was quarantined) view, release, delete or report your quarantined messages.