Data Protection Issues

How to Export Microsoft Defender Quarantine Data to CSV

Maira Mehtab Sep 22, 2026 869 views

Question details

The user needs to export recent quarantine-message information such as threat types, senders, subjects, and dates from Microsoft Defender into a CSV format.

Product: Microsoft Defender
Device & OS: not provided
Scenario: The user wants to analyze or back up quarantine message data, but the Microsoft Defender portal does not offer a direct CSV export feature for all required details.
Observed behavior: To obtain the required quarantine details in a tabular format, the administrator must extract the data using PowerShell instead of the web portal interface.

Before you start

Ensure you have Exchange Online administrator permissions and the Exchange Online PowerShell module installed on your system before running the export commands.

Solution 1Recommended

Export Quarantine Data via Exchange Online PowerShell

Use the Get-QuarantineMessage cmdlet in PowerShell to query messages, filter by dates, and export the required fields to a CSV file.

Since the Microsoft Defender portal may not provide a direct export option for all details, administrators can leverage the Get-QuarantineMessage cmdlet. This allows you to selectively filter data such as received time, sender address, and threat type directly from the command line.

Connect to Exchange Online

Open PowerShell as an administrator and connect to Exchange Online PowerShell using your Microsoft 365 admin credentials.

Prepare the Cmdlet and Date Filters

Set up the Get-QuarantineMessage command with the Where-Object clause to specify your date range, for example: $_.ReceivedTime -ge 'MM/DD/YYYY' -and $_.ReceivedTime -le 'MM/DD/YYYY'.

Select the Required Fields

Pipe the results into Select-Object to isolate the specific columns you need, such as ReceivedTime, Type, SenderAddress, Subject, and Expires.

Export to CSV

Append the Export-Csv cmdlet to output the data to your local drive. Your final script should look like this: Get-QuarantineMessage | Where-Object {$_.ReceivedTime -ge '01/01/2023' -and $_.ReceivedTime -le '01/31/2023'} | Select-Object ReceivedTime,Type,SenderAddress,Subject,Expires | Export-Csv -Path 'C:\path\quarantine.csv' -NoTypeInformation.

Documentation Updates: Always refer to the current Microsoft Learn documentation, as available fields and permissions for Get-QuarantineMessage can change in newer updates.

Free Microsoft Office alternative

View and Analyze Your CSV Export in WPS Spreadsheet

After exporting your quarantine data to CSV using PowerShell, use WPS Office as a free, lightweight, and powerful alternative to Microsoft Excel for analyzing threat logs and managing data with ease.

1. Open WPS Spreadsheet: Launch WPS Office on your computer and select the Spreadsheet tool to begin working with your data.
2. Import the CSV File: Go to Menu > Open, navigate to the folder path where you saved your quarantine.csv file, and open it.
3. Analyze the Data: Use the built-in Data tab to apply filters or create Pivot Tables, making it easy to sort through senders, subjects, and specific threat types.

Free and lightweight office suite for daily productivitySeamless format compatibility with Microsoft Excel (.csv, .xlsx)Advanced data filtering and pivot tables for analyzing threat types and sendersFamiliar user interface ensuring a zero learning curve

microsoft office alternative - wps office

Frequently Asked Questions

Why is there no direct export option in the Microsoft Defender portal?

Microsoft frequently updates the Defender portal UI. Some bulk export features for granular quarantine details are either restricted or only accessible via Exchange Online PowerShell for performance management and advanced security filtering.

Can I export quarantine data for a specific sender only?

Yes, you can modify the PowerShell command to filter by a specific sender. Add the -SenderAddress "example@domain.com" parameter to the Get-QuarantineMessage cmdlet or filter it using the Where-Object clause.

What permissions do I need to run Get-QuarantineMessage?

You must be assigned appropriate administrator roles in Exchange Online, such as Security Administrator, Security Reader, or Quarantine Administrator, to successfully run the cmdlet and view or export quarantine data.

Microsoft Office Security Issues