Security Policy Errors

How to Fix Microsoft Defender Error When Blocking a Quarantined Sender

WPS Editor Oct 9, 2026 870 views

Question details

The user encounters an error showing an incorrect or different email address when attempting to block a phishing sender directly from the quarantine list.

How to Fix Microsoft Defender Error When Blocking a Quarantined Sender

Product: Microsoft Defender
Device & OS: not provided
Scenario: Attempting to block a malicious sender from the Microsoft Defender quarantine interface.
Observed behavior: An error occurs, and the system displays a different or incorrect email address instead of the actual sender's address, preventing the block action from completing successfully.

Before you start

Ensure you have Exchange Administrator or Global Administrator privileges in your Microsoft 365 tenant to access the Exchange admin center and run message traces.

Solution 1Recommended

Run a Message Trace in the Exchange Admin Center

Using the message trace tool helps you identify the actual P1 and P2 sender addresses, which often explains why a different address appears during the block attempt.

Email spoofing or complex forwarding rules can cause the visible 'From' address to differ from the actual sender address recognized by the server. A message trace will reveal the true routing data.

Access the Exchange Admin Center

Navigate to Message Trace

In the Exchange admin center, go to 'Mail flow' and click on 'Message trace'.

Start a New Trace

Click 'Start a trace', enter the recipient's email address and the time range during which the quarantined message was received, then click 'Search'.

Review Sender Details

Open the specific message from the search results and expand the 'Message events' section. Compare the sender address listed here with the one causing the error in Microsoft Defender.

Run a Message Trace in the Exchange Admin Center

Review Anti-Spam Documentation: Consult the official Exchange Online Protection anti-spam documentation to ensure your quarantine policies are configured correctly for end-user block actions.

Solution 2

Open a Microsoft 365 Service Request

If the message trace does not resolve the discrepancy, Microsoft support must investigate backend security logs to identify the root cause of the block error.

Free Microsoft Office alternative

Looking for a Secure and Lightweight Office Suite?

While you rely on Microsoft Defender for email security, you might be looking for a more accessible alternative for your document needs. WPS Office is a lightweight, free, and highly compatible alternative to Microsoft Office, offering essential tools for Word, Excel, and PowerPoint files without the heavy subscription costs.

1. Download the Installer: Visit the official WPS website and download the free installer for your operating system.
2. Install WPS Office: Run the downloaded file and follow the simple on-screen instructions to complete the installation.
3. Open Your Office Files: Launch WPS Office and open your existing Microsoft Office documents to start editing immediately with full format compatibility.

Completely free and lightweight office suiteFamiliar UI for a seamless migration from Microsoft OfficeExcellent compatibility with Microsoft Office formats (.docx, .xlsx, .pptx)Built-in PDF reader and editor for secure document handling

microsoft office alternative - wps office

Frequently Asked Questions

Why does a different email address show when blocking a sender in Defender?

This usually happens due to email spoofing. The visible 'From' address (P2 sender) might differ from the actual sender address in the email envelope (P1 sender). Microsoft Defender often attempts to block the P1 address, causing a discrepancy in the UI.

How long are messages kept in Microsoft Defender quarantine?

By default, messages quarantined for spam, phishing, or malware are retained for 15 to 30 days, depending on how your organization's quarantine policies are configured in the Microsoft 365 Defender portal.

Can standard users block senders directly from their quarantine notification?

Yes, provided the administrator has configured the quarantine policy to grant end-users the 'Block sender' permission. If this permission is restricted, users will encounter errors or missing options.

Microsoft Office Security Issues