How to Review Microsoft Quarantined Messages

Overview:

The email address quarantine@messaging.microsoft.com is associated with the quarantine service provided by Microsoft for email security.  When an email is flagged as potentially harmful or spam, it may be sent to quarantine to protect users.  The quarantined email is placed in a secure environment where you can view its content without risk.

For legitimate cases, Microsoft Defender for Office 365 uses quarantine policies to define what users can do with their quarantined messages, like reviewing, releasing, or blocking them based on the reason they were quarantined.  Always verify the authenticity of such emails and follow safe practices when managing your email quarantine.

Training Video - How to Review Quarantine Messages

Example of a Quarantined Message:

Releasing a Quarantined Message:

The “Review message” feature in Microsoft’s quarantine service allows users and administrators to examine emails flagged and quarantined by the system’s security protocols.  When an email is quarantined, it has been identified as potentially harmful or unwanted, such as spam, phishing attempts, or containing malware.

• View the message: You can safely review the content of the quarantined email without exposing your system to potential threats.
• Release: Based on your assessment, you can request the release of the email to your inbox.  This generates a support request for Pfeiffer University’s Security Team, and the following information must be provided before the e-mail can be released instantly.  If the Security Team identifies any apparent characteristics in the quarantined email that would harm Pfeiffer University, the request will take additional time to process as it would be escalated and reviewed by our Team of Security Experts. 
  1. Do you recognize the sender and have you reviewed the message?
  2. To prevent future quarantine, kindly provide more details about the Pfeiffer Business relationship for inclusion in the always-allowed list, especially any relevant context or specifics about their association with Pfeiffer University.

How to Review a Quarantined Message:

To review a quarantined message in Microsoft’s email security service, you can follow these general steps:

1. Sign in to the Microsoft 365 Defender portal using your work or school account.  The site can be accessed on Microsoft 365 security email.
2. Navigate to Email & collaboration > Review > Quarantine.
3. Find the message you want to review.  You can use filters or search to locate a specific email.
4. Select the message to open the details window, where you can see why it was quarantined.
5. Review Email Details:
   1. Detection technologies
   2. Sender mail from address
   3. Return path
   4. Location
   5. FAIL is BAD (DMARC, DKIM, SPF, Composite authentication)
6. Select … for More Options.  Preview, release, block, or delete the message based on its legitimacy and Pfeiffer University policies.
   1. Pfeiffer University Employee Policies
   2. Pfeiffer University Student IT Policies
   3. Pfeiffer University Cybersecurity Awareness Training