Security Policy Errors

Microsoft 365 Defender Quarantine Notification Policy Options Explained

WPS Editor Sep 27, 2026 868 views

Question details

The user wants to know if Microsoft 365 Defender can be configured to send user notifications exclusively when an administrator manually selects a specific quarantined message.

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Configuring email quarantine and threat policies to manage how and when users are notified about blocked messages.
Observed behavior: The user is seeking a specific notification policy configuration that is currently not available as a straightforward native option within the Microsoft 365 Defender portal.

Before you start

Ensure you have Exchange Online Administrator or Global Administrator credentials before attempting to review or modify threat policies in the Microsoft 365 Defender portal.

Solution 1Recommended

Review Default Quarantine Policy Limitations

Understand the built-in capabilities of Microsoft 365 Defender regarding quarantine notifications to determine your configuration boundaries.

Microsoft 365 Defender currently does not provide a straightforward, out-of-the-box policy that limits user notifications solely to messages that have been manually selected by an administrator. Notifications are typically triggered automatically based on the broader policy assigned to the quarantine reason (e.g., spam, phishing).

Access the Microsoft 365 Defender Portal

Navigate to Quarantine Policies

Go to Email & Collaboration > Policies & Rules > Threat policies > Quarantine policies.

Review Available Notification Settings

Select a policy and click 'Edit'. Observe that notification settings operate on a schedule (e.g., daily or weekly) for all messages matching the policy, rather than waiting for manual administrative selection.

Review Default Quarantine Policy Limitations

System Limitation: Because manual-trigger notifications are not natively supported in the GUI, alternative automation methods are required for this specific workflow.

Solution 2

Implement Custom Automation via PowerShell

Since native policies do not support manual-trigger notifications, administrators can use PowerShell to build custom notification workflows.

Free Microsoft Office alternative

Need a Simpler Office Experience? Try WPS Office

While dealing with complex administrative policies in Microsoft 365 Defender can be time-consuming, your everyday document editing doesn't have to be. WPS Office is a free, lightweight, and powerful alternative that provides all the productivity tools you need without the administrative overhead.

1. Download WPS Office: Visit the official WPS website and download the free installation package.
2. Install the Software: Run the installer and follow the straightforward on-screen instructions to set up the suite.
3. Open and Edit: Launch WPS Office and instantly open your existing Office files to continue your work without interruption.

Free and lightweight Microsoft Office alternativeSeamless format compatibility with Microsoft Word, Excel, and PowerPoint filesFamiliar user interface ensuring zero learning curve and instant migrationNo complex cloud security policies required for local document editing

microsoft office alternative - wps office

Frequently Asked Questions

Can end users release their own quarantined emails in Microsoft 365?

This depends on the quarantine policy configured by the administrator. High-confidence phishing and malware are typically restricted to admin-only release, while bulk email or standard spam can often be reviewed and released by end users if the policy allows.

How often are quarantine notifications sent to users?

Administrators can configure quarantine notification schedules in the quarantine policy settings. Notifications can be set to be sent every 1 to 15 days, depending on the organization's preference.

Where do administrators go to manually view quarantined messages?

Administrators can view and manage all quarantined messages by navigating to the Microsoft 365 Defender portal, selecting 'Email & Collaboration', and then clicking on 'Review' followed by 'Quarantine'.

Microsoft Office Security Issues