In this article, I will demonstrate how to view quarantined emails in office 365. I’ll also show you how to release, preview, delete and view the message headers of quarantined emails in the 365 Admin Center.
Learning how to access and manage quarantined emails is essential for maintaining a secure and efficient email environment, making sure that legitimate messages are not lost, and threats are properly handled.
Contents
- What are quarantined emails
- Common Reasons Emails Get Quarantined
- How to view quarantined emails
- Preview quarantined emails
- Release emails from quarantine
- Delete quarantine emails
- View Message headers
What are Quarantined Emails
In Microsoft 365, quarantined emails are messages that are held back by the system because they might be harmful or suspicious. Instead of going straight to your inbox, these emails are placed in a secure area called quarantine to protect you from threats like spam or malware. You can review these quarantined emails to decide if they are safe. If the email is safe, you can release it to your inbox, but if it’s unsafe, you can report it to keep your account and organization secure. This process helps protect users from online dangers while still giving control over email management.
Common Reasons Why 365 Emails Get Quarantined
- Spam Detection – The email is flagged as potential spam based on content, headers, or sender reputation.
- Example, an email that is trying to sell you a weight loss product.
- Malware of Phishing detection – The email contains suspected malware attachments or links leading to infected files.
- Example, a word or excel document that has embedded code that will execute on your computer. PDF files are also often used to embed links or code.
- Policy Violations – The email violates an organization’s custom transport rules or policies, such as blocking certain keywords or attachments.
- Example, emails that contain a specific word like “click here”, “password reset” and “your password has expired”. You can modify or create additional exchange online policies to block emails based on specific words or attachments that are present in an email.
- Impersonation and Spoofing – Detected impersonation of trusted domains or users by attackers and Spoofed email addresses lacking proper authentication.
- Example, the email looks like it’s from a trusted person but it actually from a spammer.
- Bulk Email or Marketing Content – Bulk or unsolicited marketing emails can be quarantined if classified as junk.
- Example, a business sends out a mass email they have a 50% discount going on right now.
- Attachment or Link Polices – Blocked file types or restricted attachment types and links to blacklisted and unsafe websites.
- Example, the email contains an html file attachment, csv, bat, exe or some other known file type that can be malicious and is not typically sent via email.
- IP Reputation – Emails from servers or IPs with a poor or blacklisted reputation are automatically quarantined.
- Example, an email is sent from a server in China that is known for sending malicious emails.
How to View Quarantined Emails
Step 1: Log into the 365 Admin Center.
Step 2: Select Security on the left side under Admin Centers.
Step 3: On the left side go to go to email & collaboration > Review
Then select the quarantine box
You can also get to your quarantined emails quickly using this link https://security.microsoft.com/quarantine.
Preview Quarantined Emails
Step 1: In the quarantined emails list, find the email you want to preview
Step 2: Click on the email to open its details. You can view information about the email and preview the content without releasing or deleting it
Release Emails from Quarantine
Step 1: Click on the email you want to release to open its details
Step 2: Select Release Email at the top of the page
Step 3: Check your inbox for the email you selected.
Delete Emails from Quarantine
Step 1: In the quarantined list, select the checkbox next to the email or emails you want to delete.
Step 2: At the top select Delete Messages to delete your emails from quarantine.
View Message Headers
If you want to better understand the emails origin and sender, then you can look at the message headers. This will show you the senders email server and the actual senders’ email address.
Step 1: Find the quarantined email you want to view
Step 2: Select the “More Options” button to the right of Share Email
Step 3: Click “View Message Headers”
Message header example.
Conclusion
Viewing quarantine emails in Microsoft 365 is an essential process for ensuring the security of your organization’s email system while minimizing disruptions to communication. I recommend regularly reviewing quarantined messages because it enhances email security and also supports a more safer and reliable messaging environment.