How to Review Quarantined Mails in Exchange Online

Quarantined emails in Exchange Online are flagged and isolated due to potential security threats like spam, malware, phishing attempts, or policy violations. While this feature is crucial for protecting the organization from cyber threats, sometimes legitimate emails get mistakenly quarantined. Releasing these messages ensures that important communications aren't missed, and that workflow remains uninterrupted.

Before releasing a quarantined email, it is crucial to review the following details to ensure it is safe.

Steps to Release a Quarantined Message in the Microsoft 365 Defender Portal

Releasing quarantined messages in the Microsoft 365 Defender portal involves navigating through multiple tabs and sections, which can be time-consuming. Using PowerShell, admins can release these emails more efficiently.

Steps to Release a Quarantined Message using Windows PowerShell

Connect-ExchangeOnline
Release-QuarantineMessage -Identity "<Identity>" -ReleaseToAll

Release-QuarantineMessage –Identity "<Identity>" -User "<UserPrincipalName>"

Bulk Release Quarantined Messages in Microsoft 365

Bulk release can be considered for emails from a trusted sender. If emails from a trusted sender are quarantined, you can verify the sender's details and then release all emails from that sender in bulk using this option.

After the quarantined messages are released, they will be delivered to the intended recipient's mailbox.

Important Points:

An admin should monitor the quarantined messages report for a specific recipient, such as an executive or high-profile employee, to protect against targeted phishing attacks. Executives are often prime targets for spear-phishing and other sophisticated attacks. By closely monitoring their quarantined messages, admins can quickly address potential threats. This helps fine-tune email filters, reduce false positives, and ensure high-priority users receive all legitimate communications promptly.

To get a quarantined messages report for a specific recipient in Microsoft 365, you can use the Microsoft 365 Defender portal or PowerShell.

Using Microsoft 365 Defender

Using Exchange Online PowerShell

Connect-ExchangeOnline
Get-QuarantineMessage | Where-Object {$_.RecipientAddress -eq "<UserMailAddress>"}

As an admin, you may need to block senders who consistently send spam, malware, or phishing emails to your organization users. This helps to protect your organization from potential security breaches and reduce the load on your email filtering systems.

To block the sender of quarantined message, follow the steps below.

Once you block a sender, their future messages will go to the Junk Email folder. This ensures that their emails do not reach users' inboxes, maintaining the security and integrity of your email system.

Managing quarantined emails in Microsoft 365 involves several actions such as releasing emails, deleting messages, previewing messages, viewing message headers, and blocking a sender.

Admins need to understand these operations as they are crucial in maintaining email security and effective management of quarantined messages. We will dive deep into each of these actions in the following sections.

Delete a Quarantined Email

Deleting quarantined emails in Microsoft 365 is a crucial task for admins, not only to eliminate potentially harmful content and maintain security but also to manage storage space effectively. By removing suspicious emails, you prevent the risk of malicious content being inadvertently released. Additionally, you can free up storage space consumed by these quarantined messages.

You can also delete a quarantined message via PowerShell using the 'Delete-QuarantineMessage' cmdlet.

Preview a Quarantined Message

Examining the body of a quarantined email without releasing it to the intended recipient is a crucial step. This helps admins in determining whether the email poses a security threat or if it has been mistakenly flagged. By previewing the message, admins can make informed decisions about whether to release, delete, or investigate the email further, thereby protecting the organization from potential cyber security threats.

To preview a quarantined message via PowerShell, you can use the 'Preview-QuarantineMessage' cmdlet.

View the Message Header of a Quarantined Email

Inspecting the message header of a quarantined email allows admins to inspect details about the email's routing and origin. It helps to analyze the email source, understand its path through servers, and identify security issues or reasons for quarantine. By examining the message header, admins can assess the email's legitimacy and take appropriate action to protect the organization's email environment.

• With AdminDroid's quarantined mails report, you can effortlessly monitor and manage quarantine email activities, ensuring enhanced security and control.
• This report provides details on actions performed, who executed them, when they were done, the result status, etc.

Pro Tip: Use the easy filter operation to audit specific activities, such as when a user releases a quarantined message, to track and analyze these actions effectively.

Understanding the conditions that trigger email quarantine in Exchange Online is crucial for admins to effectively manage and secure their organization's email communications. By being aware of these triggers, admins can fine-tune their email filtering policies. This helps reduce false positives, ensuring legitimate emails are delivered and potential security threats are addressed promptly.

Conditions that trigger email quarantine in Exchange Online are,

By understanding these various conditions that trigger email quarantine in Exchange Online, admins can effectively manage and secure their organization's email communications. Admins should utilize Exchange Online Protection (EOP) and Advanced Threat Protection (ATP) features to fine-tune email filtering policies, reduce false positives, and quickly address potential security threats.