Security Policy Errors

How to Set Default Release Status Filters in Microsoft Defender Quarantine

Bushra Parveen Oct 8, 2026 868 views

Question details

Administrators want to change the default Microsoft Defender quarantine filter from 'Time received' to 'Release status: Needs review' for all users.

How to Set Default Release Status Filters for Microsoft Defender Quarantine

Product: Microsoft Defender XDR
Device & OS: not provided
Scenario: Configuring default viewing filters for Microsoft Defender Quarantine to streamline administrative workflows across a tenant.
Observed behavior: The Defender quarantine page currently defaults to a 'Time received' filter, such as the Last 30 days, rather than the desired 'Needs review' release status.

Before you start

Ensure you have the necessary administrator permissions (such as Security Administrator or Global Administrator) in the Microsoft 365 Defender portal before attempting to modify tenant-wide quarantine settings.

Solution 1Recommended

Seek Expert Guidance from the Microsoft Defender XDR Community

Since changing the hardcoded default filter in the Defender UI to 'Needs review' globally may require advanced backend configuration or a feature request, consulting Microsoft experts is the most effective approach.

Microsoft Defender's default UI behavior often relies on standard templates like the 'Time received' filter. Modifying this specific default view for all users across a tenant is a highly specialized request that might not be natively supported in the standard Threat Policies dashboard.

Navigate to the Tech Community

Open your web browser and visit the official Microsoft Defender XDR community forum at techcommunity.microsoft.com.

Search for existing filter topics

Use the search bar to look for 'Default Release Status Filters' to see if other administrators have recently found a workaround or script for this specific requirement.

Post your tenant requirements

If no solution exists, create a new post detailing your need to set 'Release status: Needs review' as the default for all users. Microsoft engineers and Defender experts actively monitor this space to provide PowerShell workarounds or log feature requests.

Seek Expert Guidance from the Microsoft Defender XDR Community

Community Support: The Microsoft Tech Community is the official channel for complex XDR configuration queries that go beyond standard UI toggles.

Solution 2

Verify Current Quarantine Policies in Microsoft 365 Defender

Check your existing quarantine policies to ensure notifications and review requests are properly routed, even if the default UI filter cannot be immediately changed.

Free Microsoft Office alternative

Enhance Your Productivity with WPS Office

While resolving Microsoft Defender security policies, you might also be looking for a fast, reliable way to manage your daily reports and documents. WPS Office is a highly compatible, lightweight, and free alternative to Microsoft Office, offering an intuitive experience for managing documents, spreadsheets, and presentations.

1. Visit the WPS Office Website: Go to the official WPS Office website to access the free download.
2. Download the Installer: Click the 'Free Download' button to get the installer for Windows, Mac, or Linux.
3. Install and Edit: Run the installer, open WPS Office, and immediately start working with your existing Microsoft Office files.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation ensures fast loading times and smooth system performance.Familiar user interface allows for a seamless transition with zero learning curve.Built-in PDF editing tools make reviewing and signing security reports effortless.

microsoft office alternative - wps office

Frequently Asked Questions

Can I set 'Needs review' as the default quarantine filter for all users?

Currently, the Microsoft Defender UI defaults to a 'Time received' filter. Setting a global default to 'Needs review' is not natively exposed as a simple toggle and typically requires consulting with Microsoft Support or the Defender XDR community for specialized workarounds.

Where do I manage quarantine settings in Microsoft Defender?

Quarantine settings and policies can be managed in the Microsoft 365 Defender portal by navigating to Email & collaboration > Policies & rules > Threat policies > Quarantine policies.

Who has permission to change global quarantine filters?

Modifying tenant-wide settings in Microsoft 365 Defender requires high-level administrative privileges, such as the Security Administrator or Global Administrator roles.

What is the standard default filter in Defender Quarantine?

By default, the quarantine page displays items based on the 'Time received' filter, usually filtering for messages and files quarantined within the last 30 days.

Microsoft Office Security Issues