> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/email/administration/quarantine.md). # Quarantine This page lists the messages Microsoft Defender for Office 365 and Exchange Online Protection have quarantined for the selected tenant. From here you can inspect a message safely, trace how it arrived, and release, deny, or delete it without going into the Defender portal. Quarantine is split into three tabs, one for each type of quarantined item. This page covers the **Email** tab, which is the one you land on. | Tab | Contents | | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Email | Quarantined email messages, with the full set of investigation and remediation actions. | | Files | Files quarantined from SharePoint, OneDrive, and Microsoft Teams. See [Files](/user-documentation/email/administration/quarantine/files.md). | | Teams Messages | Quarantined Microsoft Teams messages. See [Teams Messages](/user-documentation/email/administration/quarantine/teams.md). | ## Filters | Filter | Shows | | ------------------------ | --------------------------------------------------------------------------------------------- | | Not Released | Messages still sitting in quarantine with no request against them. | | Released | Messages that have already been released to their recipients. | | Requested | Messages a recipient has asked to have released, which are the ones waiting on your decision. | | High Confidence Phishing | Messages quarantined as high confidence phishing. | | Phishing | Messages quarantined as phishing. | | Spam | Messages quarantined as spam. | | Malware | Messages quarantined as malware. | | Bulk | Messages quarantined as bulk mail. | | Transport Rule | Messages quarantined by a mail flow rule. | A release-status filter and a quarantine-reason filter can be active at the same time. ## Table Details The properties returned are for the Exchange Online PowerShell command `Get-QuarantineMessage`. For more information on the command please see the [Microsoft documentation](https://learn.microsoft.com/powershell/module/exchangepowershell/get-quarantinemessage). Messages are listed newest first. Choosing AllTenants starts a background job to gather messages from every tenant, so the table reports that it is still loading until that job finishes. ## Message Details **More Info** opens a flyout holding everything CIPP can establish about the message. The top of the flyout shows the subject, the reason it was quarantined, its release status, and how many attachments and links it contains. Below that are expandable sections: | Section | Contents | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | Quarantine Details | When the message arrived and when it expires, the quarantine reason, the policy that caught it, and its release history. | | Delivery Details | Where the message was originally delivered and where it ended up, the detections that fired against it, and the spam, phishing, and bulk confidence levels. | | Email Details | Sender display name, addresses, sending IP and location, recipients, direction, message IDs, size, and language. | | Authentication | The DMARC, DKIM, SPF, and composite authentication results. | | URLs | Every link found in the message, with its threat verdict and the detection method that produced it. Shown only when the message contains links. | | Attachments | Every attachment, with its threat verdict, malware family, size, and SHA256 hash. Shown only when the message has attachments. | Fields with no value are left out rather than shown empty, so the sections vary in length from message to message. The actions offered in the table are repeated at the foot of the flyout. Where Microsoft Defender for Office 365 has analysed the message, the delivery, authentication, URL, and attachment detail comes from Microsoft's own analysis. Where it has not, CIPP falls back to reading the message headers and the message itself, and the flyout says so. The fallback still lists the links and attachments it finds, but Microsoft's per-link verdicts are not available for them. {% hint style="info" %} The enriched detail needs the `SecurityAnalyzedMessage.Read.All` permission on your Secure Application Model application. Without it the flyout falls back to the header-based view. Check your permissions under **CIPP > Application Settings > Permissions** if the sections look thinner than expected. {% endhint %} ## Table Actions {% hint style="info" %} Under AllTenants, each action runs against the tenant the message belongs to rather than against the tenant selected at the top of CIPP. {% endhint %}
ActionDescriptionBulk Action Available
ReleaseReleases the message to all of its recipients. Greyed out on a message that has already been released.true
Release & Allow SenderReleases the message and adds the sender to the allowed senders list of the anti-spam policy that quarantined it, so future mail from them is not quarantined. Greyed out on a message that has already been released.true
DenyTurns down a recipient's request to have the message released. Greyed out unless the recipient has actually requested release.true
Delete from QuarantinePermanently deletes the message from quarantine. Greyed out on a message that has already been released.true
Preview MessageOpens a modal that renders the quarantined message so its contents, headers, and attachments can be inspected safely.false
View Message HeadersOpens a modal showing the message's raw internet headers.false
Download Message (.eml)Downloads the message as a .eml file, named after its subject, for analysis outside CIPP.false
View Message TraceOpens a modal with a table of the message's trace history, showing where it was received from and what happened to it at each step.false
Submit to Microsoft for ReviewSends the message to Microsoft as a threat submission so they can review how it was classified. Asks which category to report it under: clean, spam, phishing, or malware.false
Block SenderAdds the sender to the tenant's /pages/KedX3LU5hOge2TigmaFr as a blocked sender. The entry expires after 30 days unless you switch it to never expire, and an optional note can be attached.true
Open Email Entity in DefenderOpens the message's entity page in Microsoft Defender in a new tab, for the detection detail CIPP does not surface.false
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="warning" %} **Release & Allow Sender** adds a standing allow entry to the anti-spam policy, and that entry stays until it is removed by hand. Use it for a sender that is genuinely being caught wrongly, and prefer a plain **Release** otherwise. The message is released either way: if the allow entry cannot be added, the release still goes through and the failure is recorded in the logs. {% endhint %} {% hint style="danger" %} **Delete from Quarantine** removes the message outright. There is no recovery afterwards, so preview or download anything you might need first. {% endhint %} {% hint style="info" %} **Submit to Microsoft for Review** submits the message to Microsoft's threat submission service. Submissions are analysed by Microsoft and help correct both false positives and false negatives, so a message you release because it was wrongly caught is worth reporting as clean. {% endhint %} *** ## Feature Requests / Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cipp.app/user-documentation/email/administration/quarantine.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.