Skip to Content
SecurityThreat ProtectionQuarantine

Quarantine

Manage quarantined emails, files, and messages that were blocked by security policies.

Quarantine Sources

SourceContent Type
Anti-spamSpam and bulk email
Anti-malwareMessages with malware
Anti-phishingPhishing attempts
Safe AttachmentsSuspicious attachments
DLPData loss prevention matches
Transport rulesMessages matching transport rules

Admin Actions

  • Preview — View quarantined message content safely
  • Release — Deliver the message to the original recipient
  • Delete — Permanently remove from quarantine
  • Report — Submit to Microsoft for analysis
  • Allow sender — Add sender to allow list

Quarantine Policies

Control what end users can do with their quarantined messages:

  • No access — Only admins can manage (default for malware)
  • Limited access — Users can preview and request release
  • Full access — Users can release messages themselves

API Reference

  • GET /api/security/quarantine — List quarantined items
  • POST /api/security/quarantine/:id/release — Release item
  • DELETE /api/security/quarantine/:id — Delete item
Last updated on
IncidentsSafe Attachments