Security Policy Errors

How to Fix Users Cannot View or Release Messages from Preset Quarantine Policies in Microsoft 365

John Wilson Oct 14, 2026 868 views

Question details

Users are unable to see or release quarantined emails in their user portal when the messages are blocked by preset quarantine policies, whereas custom policies work fine.

Fixing User Access to Preset Quarantine Policy Messages in Microsoft 365

Product: Microsoft 365 Exchange Online Protection / Defender
Device & OS: not provided
Scenario: Users are attempting to view or release legitimate emails that were incorrectly flagged and quarantined by the system.
Observed behavior: Messages quarantined by preset policies (often flagged as high-confidence phishing) are completely hidden from the user's quarantine portal to prevent accidental release.

Before you start

Ensure you have Microsoft 365 Global Administrator or Security Administrator privileges before modifying quarantine policies, as standard users cannot change these organization-wide security settings.

Solution 1Recommended

Release Messages Manually as an Administrator

Since high-confidence phishing messages are hidden from users by design, administrators must manually review and release false positives.

Microsoft designs preset security policies with strict rules. To prevent users from accidentally releasing malicious emails, messages categorized as 'phishing' or 'high-confidence phishing' bypass the user quarantine view entirely.

Open Microsoft 365 Defender

Navigate to Quarantine

Go to Email & Collaboration > Review > Quarantine on the left-hand navigation pane.

Locate the Hidden Messages

Use the filter options to search for the specific user's blocked messages or filter by the 'Phishing' category.

Review and Release

Select the incorrectly flagged message and click 'Release email' to deliver it to the user's inbox.

Release Messages Manually as an Administrator

By Design Behavior: Microsoft support confirms that hiding high-confidence phishing messages from standard users is an intended security measure and currently has no direct bypass.

Solution 2

Disable Preset Policies for Affected User Groups

If critical legitimate messages are consistently flagged, you can exclude specific groups from preset policies and use custom policies instead.

Solution 3

Create a Service Request with Microsoft Support

If you need further clarification on policy behavior or require advanced administrative options, contact Microsoft Support.

Free Microsoft Office alternative

Looking for a Lightweight, Reliable Office Suite?

While managing complex Microsoft 365 security policies can be demanding, your daily document work doesn't have to be. WPS Office provides a lightweight, highly compatible, and easy-to-use alternative to Microsoft Office, letting you focus on productivity.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation with blazing fast startup times.Free to use with a familiar, intuitive tabbed interface.Built-in PDF editing tools right alongside your documents.

microsoft office alternative - wps office

Frequently Asked Questions

Why can't users see messages quarantined by preset policies?

Microsoft's preset security policies are designed with strict security measures. Messages classified as phishing or high-confidence phishing are intentionally hidden from the user's quarantine page to prevent them from accidentally releasing malicious content into their inbox.

Can I bypass the restriction on preset quarantine policies?

There is currently no direct bypass within the preset policies themselves. To allow users to manage these messages, administrators must exclude those users from the preset policy and create a custom policy with more lenient quarantine access settings.

How do I release a high-confidence phishing email that is a false positive?

A Microsoft 365 Administrator must log into the Microsoft 365 Defender portal, navigate to the Quarantine section under Email & Collaboration, find the specific blocked email, and manually release it to the intended recipient.

What is the difference between custom and preset quarantine policies?

Custom policies allow administrators to define exactly who can view and release quarantined messages for various threat types. Preset policies enforce Microsoft's recommended baseline security settings, which restrict user access to severe threats like high-confidence phishing.

Microsoft Office Security Issues