Security Policy Errors

Microsoft Defender: Block Sender, Report Message, and Quarantine Explained

Huma Ashraf Ch Oct 21, 2026 868 views

Question details

The user wants to understand the distinct purposes and impacts of the Report Message, Block Sender, and Quarantine features in Microsoft Defender for handling unwanted emails.

Microsoft Defender: Block Sender, Report Message, and Quarantine Explained

Product: Microsoft Defender
Device & OS: not provided
Scenario: Managing spam, phishing, and malware emails within a personal inbox or across an organizational tenant.
Observed behavior: Users are uncertain about when to report versus block an email, and whether actions taken in the quarantine portal apply only to their personal mailbox or to the entire organizational tenant.

Before you start

Before modifying quarantine settings or tenant-wide block lists, ensure you understand your organization's IT security guidelines, as some quarantine actions may require administrative privileges.

Solution 1Recommended

Using Report Message and Block Sender in Your Inbox

Use these actions to handle suspicious or annoying emails that bypass system filters and land directly in your inbox.

The Report Message and Block Sender features serve different but complementary purposes. Reporting helps improve global security filters, while blocking stops a specific sender from reaching your inbox.

Report suspicious emails

If a phishing, malware, or spam email reaches your inbox, use the 'Report Message' button. This submits the message to Microsoft for analysis, helping improve filters for everyone, and removes the email from your inbox.

Block specific senders

Use the 'Block Sender' option when you want to prevent future messages from a specific email address. This adds the sender to your personal blocked senders list.

Combine actions for maximum security

For highly suspicious emails, you can report the message first and then block the sender to ensure personal protection while contributing to global threat intelligence.

Using Report Message and Block Sender in Your Inbox

Quarantined Emails: If an email is already in quarantine, Microsoft has already flagged it as suspicious. You generally do not need to use the Report Message function for these emails.

Solution 2

Handling Quarantined Emails and Tenant Policies

Manage emails that have been intercepted by Microsoft Defender before reaching your inbox, and understand tenant-wide impacts.

Free Microsoft Office alternative

Enhance Your Productivity with WPS Office

While Microsoft Defender secures your emails, WPS Office provides a lightweight, secure, and cost-effective solution for all your document needs. It serves as an excellent alternative to Microsoft Office, offering full compatibility without the heavy resource usage.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install the software: Run the downloaded installer and follow the simple on-screen instructions to set up the office suite.
3. Open and edit your files: Launch WPS Office to instantly open, securely edit, and save your existing Microsoft Office documents.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Lightweight design ensures fast startup and minimal system resource consumption.Built-in robust PDF editing and document protection features for secure file handling.Familiar tabbed interface allows for a seamless and intuitive migration from Microsoft Office.

microsoft office alternative - wps office

Frequently Asked Questions

Do I need to report an email that is already in quarantine?

No, if Microsoft Defender has already quarantined the email, it has met the filtering threshold and is recognized as suspicious. Reporting it again is usually unnecessary.

Does blocking a sender from the quarantine email affect everyone in my company?

It depends on your organization's configuration. In many Microsoft 365 environments, blocking a sender directly from the administrative quarantine portal applies the block to the entire tenant, preventing that sender from reaching any employee.

Why do deleted addresses keep reappearing in my Safe Senders list?

This typically happens if your organization uses global directory synchronization or tenant-wide group policies that automatically push and overwrite your personal Outlook Safe Senders settings. You may need to contact your IT administrator to adjust tenant policies.

What is the primary difference between blocking a sender and reporting a message?

Blocking a sender simply adds their specific email address to your blocked list, routing their future emails to your Junk folder. Reporting a message sends a copy of the email to Microsoft for analysis, which helps improve global spam and phishing filters for all users.

Microsoft Office Security Issues