Security Policy Errors

How to Send Soft-Deleted Messages to Quarantine in Microsoft Defender

Chanuka Geekiyanage Oct 14, 2026 868 views

Question details

The user needs to configure Microsoft Defender to quarantine suspected threat messages rather than permanently deleting them.

How to Send Soft-Deleted Messages to Quarantine in Microsoft Defender

Product: Microsoft Defender
Device & OS: not provided
Scenario: Setting up email security policies to manage suspected spam, phishing, or malware.
Observed behavior: Messages are currently being soft-deleted or bypassing quarantine due to incorrect mail-flow rules or default policy actions.

Before you start

Ensure you have the necessary administrative permissions, such as the Security Administrator or Organization Management role, to modify threat policies in the Microsoft 365 Defender portal.

Solution 1Recommended

Configure Action Settings in Threat Policies

Instead of using mail-flow rules, you must modify the native anti-spam, anti-phishing, or anti-malware policies to route suspected messages to quarantine.

Quarantine behavior should not be configured by creating a mail-flow (Exchange transport) rule that changes the spam confidence level (SCL) or attempts to move a message directly. Doing so can bypass native protections. Instead, you must adjust the dedicated threat policies.

Open the Microsoft Defender Portal

Log in to the Microsoft 365 Defender portal using your admin credentials and navigate to the 'Email & collaboration' section in the left sidebar.

Navigate to Threat Policies

Click on 'Policies & rules', select 'Threat policies', and then choose the specific policy type you want to configure (Anti-spam, Anti-phishing, or Anti-malware).

Edit the Protection Actions

Select the specific policy you wish to modify and click on 'Edit actions' at the bottom of the flyout pane.

Set Action to Quarantine

Under the message actions for spam, phishing, or malware, change the dropdown selection to 'Quarantine message'. Review the corresponding quarantine policy that determines user notifications, then save your changes.

Configure Action Settings in Threat Policies

Available Settings Variation: The exact options and quarantine policies available in the dropdown menus will depend on your organization's specific licensing, existing threat policies, and your admin permissions.

Free Microsoft Office alternative

Need a Secure and Reliable Office Suite for Your Business?

While you manage your organization's email security in Microsoft Defender, equip your team with WPS Office for daily document tasks. It is a lightweight, cost-effective alternative to Microsoft Office that offers comprehensive tools for Word, Excel, PowerPoint, and PDF files without compromising on security.

1. Download WPS Office: Visit the official WPS Office website and download the free installer for your operating system.
2. Install and Launch: Run the setup file and follow the quick installation prompts to set up the software on your device.
3. Open Existing Office Files: Launch WPS Office and open your existing Word, Excel, or PowerPoint documents directly with seamless formatting retention.

Fully compatible with Microsoft Office formats like DOCX, XLSX, and PPTX.Secure local document editing to keep your sensitive data protected.Lightweight installation that runs smoothly on Windows, Mac, and Linux.Cost-effective solution to reduce overhead while maintaining productivity.

Frequently Asked Questions

Why shouldn't I use mail-flow rules for quarantining messages?

Using Exchange mail-flow rules to adjust spam confidence levels or force messages into quarantine can interfere with Microsoft Defender's built-in threat intelligence, leading to inconsistent security behaviors and reporting.

How long do messages stay in the Defender quarantine?

By default, quarantined messages are retained for a specific period (often 15 to 30 days, depending on your policy configuration) before they are permanently deleted from the system.

Can end users release their own quarantined messages?

Yes, if the assigned quarantine policy permits it, users can review and request the release of certain quarantined emails. However, high-confidence phishing or malware usually requires administrative approval to release.

Who has permission to manage quarantine policies?

Only users assigned appropriate administrative roles in Microsoft 365, such as Security Administrator, Quarantine Administrator, or Global Administrator, can configure or modify threat and quarantine policies.

Microsoft Office Security Issues