How to Reduce False Positives in Microsoft 365 Email Quarantine
Question details
The user needs to prevent legitimate incoming emails from being incorrectly marked as malware, phishing, or spam and sent to the quarantine folder.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Managing organizational email security policies to balance threat protection with the reliable delivery of legitimate messages.
- Observed behavior
- Legitimate messages are being frequently quarantined due to overly strict preset security policies, bulk email thresholds, or Safe Attachments rules.
Ensure you have Exchange Online Administrator or Security Administrator permissions in your Microsoft 365 tenant to view and modify global threat policies.
Switch from Strict to Standard Preset Security Policies
The Strict preset applies aggressive filtering that often causes higher false positives. Downgrading appropriate users to the Standard preset can significantly reduce unnecessary quarantines.
Microsoft 365 offers Standard and Strict preset security policies. While Strict is excellent for high-value targets, applying it organization-wide often traps legitimate emails.
Log in to the Microsoft 365 Defender portal, navigate to 'Email & Collaboration' in the left menu, and click on 'Policies & Rules'.
Select 'Threat policies', then click on 'Preset security policies' under the Templated policies section.
Locate the 'Strict protection' profile and click 'Edit' to review the users, groups, or domains currently assigned to this policy.
Remove general employees from the Strict profile and add them to the 'Standard protection' profile instead, saving your changes.
Adjust Bulk Email Thresholds and Add Trusted Senders
Fine-tune your anti-spam settings to allow legitimate marketing or bulk emails and ensure trusted partners bypass the quarantine filters.
Looking for a Lightweight Alternative to Microsoft Office?
While managing Microsoft 365 email security policies can be complex and time-consuming for admins, managing your daily documents shouldn't be. WPS Office offers a free, lightweight, and highly compatible alternative for creating, editing, and sharing Word, Excel, and PowerPoint files without the overhead of heavy enterprise subscriptions.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install WPS Office: Run the downloaded installer file and follow the quick on-screen setup instructions.
- 3. Open Your Office Files: Launch WPS Office and directly open your existing Microsoft Office documents without any conversion steps.
Frequently Asked Questions
Why are internal emails going to quarantine in Microsoft 365?
Internal emails can be quarantined if they contain suspicious links, trigger Safe Attachments policies, or if a potentially compromised internal account is detected sending spam or malware within the organization.
How can users release their own quarantined messages?
Administrators can configure quarantine policies to allow end-users to view and request release, or directly release certain types of quarantined messages (like spam or bulk email) through the Microsoft 365 Defender end-user quarantine portal.
What is the primary difference between Strict and Standard security presets?
The Strict preset applies more aggressive thresholds for spam, phishing, and malware detection. It prioritizes maximum security over delivery convenience, which naturally leads to a higher rate of false positives compared to the Standard preset.
Should I use broad domain exclusions to stop false positives from a specific company?
No, it is highly recommended to avoid broad domain exclusions, as attackers frequently spoof legitimate domains. Instead, rely on adjusting policy thresholds, adding specific verified sender addresses, or relying on tenant allow/block lists.
