Why Microsoft 365 Messages Have Different Quarantine Statuses
Question details
The user wants to understand why some suspected spam or phishing messages are delivered while others are quarantined, even when the recipients share the same license tier.
- Product
- Microsoft 365 Defender
- Device & OS
- not provided
- Scenario
- Reviewing message traces to monitor email delivery and troubleshoot inconsistent security filtering.
- Observed behavior
- Some messages are marked as completed while others are sent to quarantine, despite recipients having identical Microsoft 365 licenses.
Ensure you have administrator access to the Microsoft 365 Defender portal to view detailed message traces, threat explorers, and quarantine policies.
Review Message Details in Microsoft 365 Defender
Investigate the specific threat detection results and routing rules applied to each message to understand the quarantine status.
Quarantine status is primarily determined by Microsoft 365 threat intelligence and filtering policies (such as anti-spam, anti-phishing, and anti-malware), not solely by the recipient's license. Reviewing the message trace reveals exactly which policy triggered the action.
Log in to the Microsoft 365 Defender portal using your administrator credentials.
On the left-hand navigation pane, expand the 'Email & Collaboration' section and click on 'Explorer' or 'Real-time detections'.
Use the search bar to locate the specific message using its Message ID, sender address, or recipient details.
Click on the message to open the details pane. Check the 'Threat Explorer' section to identify which specific security policy (e.g., malware, high-confidence phishing) caused the message to be quarantined.
Manage Quarantine Policies and Release Messages
Modify quarantine policies if legitimate emails are being incorrectly blocked, or manually release false positives.
Try WPS Office for a Streamlined Document Experience
While managing complex email security policies requires Microsoft 365 admin tools, your daily document work doesn't have to be complicated or expensive. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office, providing Word, Excel, PowerPoint, and PDF tools in one seamless application.
- 1. Download the Installer: Visit the official WPS Office website and download the free version for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen prompts to set up the software in minutes.
- 3. Open Your Files: Launch WPS Office and directly open your existing Word, Excel, and PowerPoint files without any formatting loss.
Frequently Asked Questions
Does a user's license affect their email quarantine status?
No, quarantine status is primarily determined by Microsoft 365 filtering policies (anti-spam, anti-phishing, anti-malware) rather than the recipient's specific license type. However, higher-tier licenses may offer deeper threat analytics.
Can regular users release their own quarantined messages?
Yes, if the administrator has configured the quarantine policy to allow users to review and release less harmful messages, such as bulk email or basic spam. High-confidence phishing and malware always require admin approval.
Why would a message trace show a message as completed if it was malicious?
A message might bypass filters if the sender is on a Safe Senders list, if an Exchange mail flow rule overrides the spam filter, or if the threat intelligence did not detect the malicious payload at the exact time of delivery.
How long are messages kept in the Microsoft 365 quarantine?
By default, quarantined messages are retained for 30 days. After this retention period, they are automatically permanently deleted and cannot be recovered by users or administrators.
