# How do quarantine policies and notifications work in Microsoft 365?

URL: https://iblockspam.com/blog/microsoft-365-quarantine-policies-notifications
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Design Microsoft 365 quarantine policies: default policies, user permissions, custom policies, notification frequency, branding, languages and assignment.

## Short answer

A quarantine policy decides what users can do with their own quarantined messages and whether they get notification emails. Microsoft 365 includes AdminOnlyAccessPolicy, DefaultFullAccessPolicy and DefaultFullAccessWithNotificationPolicy. You assign one to each quarantine verdict in anti-spam, anti-phishing, anti-malware and Safe Attachments policies, and set notification frequency, sender, logo and languages globally.

Quarantine is only useful if the right people can see what's in it. Microsoft 365 controls that with quarantine policies: small permission profiles attached to each verdict that quarantines mail. Get them wrong and users either never learn a real invoice was held, or can release a phishing email with one click. This guide covers how the policies are built, which ones Microsoft assigns by default, and how to set up notifications people will read.

For the day-to-day job of finding and releasing a message, see [how to release quarantined email in Microsoft 365](https://iblockspam.com/blog/release-quarantined-email-microsoft-365). This guide is about the policy design behind it.

## What is a quarantine policy?

[Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-policies) says quarantine policies let admins define two things:

- What users can do to their own quarantined messages, based on why the message was quarantined.
- Whether users receive periodic notifications "every four hours, daily, or weekly."

Quarantine policies are available in every organization with cloud mailboxes. You manage them at **Email & collaboration** > **Policies & rules** > **Threat policies** > **Quarantine policies** in the **Rules** section of the Defender portal (`https://security.microsoft.com/quarantinePolicies`).

Two rules apply everywhere:

- A policy change only affects messages quarantined *after* you make it. Already-quarantined messages keep their old permissions.
- How long messages stay in quarantine isn't set here. The **Retain spam in quarantine for this many days** setting in anti-spam policies controls it for anti-spam and anti-phishing quarantine: 1 to 30 days, 15 by default, 30 in Standard and Strict. Our guide to [anti-spam policies](https://iblockspam.com/blog/microsoft-365-anti-spam-policies) covers that setting.

## What permissions can a quarantine policy grant?

Each policy is a set of individual permissions. Microsoft groups them into three presets:

| Permission | No access | Limited access | Full access |
|---|---|---|---|
| View message header | Yes | Yes | Yes |
| **Allow sender** | | Yes | Yes |
| **Block sender** | | | |
| **Delete** | | Yes | Yes |
| **Preview** | | Yes | Yes |
| **Allow recipients to release a message from quarantine** | | | Yes |
| **Allow recipients to request a message to be released from quarantine** | | Yes | |

**Block sender** isn't in any preset; you add it with a custom policy.

Some verdicts ignore the release permission entirely. Microsoft says users can't release their own messages quarantined as malware by anti-malware or Safe Attachments, as phishing by Safe Attachments, or as high confidence phishing by anti-spam policies, "regardless of how the quarantine policy is configured." If the policy allows release, users can only *request* it.

With **No access** and notifications on, users get a notification but the only action is **Review message**. That's useful when you want people to know mail was held without letting them act on it.

## Which default quarantine policies exist?

| Default policy | Permissions | Notifications |
|---|---|---|
| **AdminOnlyAccessPolicy** | No access | Off |
| **DefaultFullAccessPolicy** | Full access | Off |
| **DefaultFullAccessWithNotificationPolicy** | Full access | On |
| **NotificationEnabledPolicy** (some tenants) | Full access | On |

Their permissions and notification settings are read-only. NotificationEnabledPolicy only exists in tenants created before quarantine policies arrived in July to August 2021 that had turned on end-user spam notifications in an anti-spam policy.

Here's what Microsoft's [recommended settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365) assign at the time of writing (October 2026):

| Verdict | Default policies | Standard preset | Strict preset |
|---|---|---|---|
| Spam | DefaultFullAccessPolicy | DefaultFullAccessPolicy | DefaultFullAccessWithNotificationPolicy |
| High confidence spam | DefaultFullAccessPolicy | DefaultFullAccessWithNotificationPolicy | DefaultFullAccessWithNotificationPolicy |
| Phishing | DefaultFullAccessPolicy | DefaultFullAccessWithNotificationPolicy | DefaultFullAccessWithNotificationPolicy |
| High confidence phishing | AdminOnlyAccessPolicy | AdminOnlyAccessPolicy | AdminOnlyAccessPolicy |
| Bulk | DefaultFullAccessPolicy | DefaultFullAccessPolicy | DefaultFullAccessWithNotificationPolicy |
| Spoof (anti-phishing) | DefaultFullAccessPolicy | DefaultFullAccessPolicy | DefaultFullAccessWithNotificationPolicy |
| User and domain impersonation | DefaultFullAccessPolicy | DefaultFullAccessWithNotificationPolicy | DefaultFullAccessWithNotificationPolicy |
| Malware (anti-malware) | AdminOnlyAccessPolicy | AdminOnlyAccessPolicy | AdminOnlyAccessPolicy |

Microsoft notes the policy is "meaningful only if" that verdict is actually quarantined. In the default anti-spam policy, spam, high confidence spam, phishing and bulk all go to Junk Email, so their quarantine policy never applies until you change the action.

Note that the default for phishing is **Full access**. Anyone with that policy can release a phishing message without asking. In our view, for most businesses that's the first thing to change.

## How do you create a custom quarantine policy?

1. On the **Quarantine policies** page, select **Add custom policy**.
2. On **Policy name**, give it a name you'll recognize in drop-down lists, such as "Phish – request release + notify".
3. On **Recipient message access**, choose **Limited access**, or **Set specific access (Advanced)** to pick permissions yourself:
   - **Select release action preference**: blank (no release), **Allow recipients to request a message to be released from quarantine**, or **Allow recipients to release a message from quarantine**.
   - **Select additional actions recipients can take on quarantined messages**: **Delete**, **Preview**, **Block sender**, **Allow sender**.
4. On **Quarantine notification**, select **Enable**, then choose **Include quarantined messages from blocked sender addresses** or **Don't include quarantined messages from blocked sender addresses**. The second option also leaves out bulk detections.
5. Review and select **Submit**.

The PowerShell equivalent uses a decimal permissions value. Microsoft gives 43 for Limited access:

```powershell
New-QuarantinePolicy -Name "LimitedWithNotify" -EndUserQuarantinePermissionsValue 43 -EsnEnabled $true
```

`EsnEnabled $true` turns notifications on; they're off by default.

## How do you assign quarantine policies to protection features?

Quarantine policies are picked inside the policy that quarantines the message, not on the quarantine policy itself.

| Where | Path in the Defender portal | Setting |
|---|---|---|
| Anti-spam | **Threat policies** > **Anti-spam** > policy > **Edit actions** | **Select quarantine policy** next to each verdict set to **Quarantine message** |
| Anti-phishing | **Threat policies** > **Anti-phishing** > policy > **Actions** | **Apply quarantine policy** next to each **Quarantine the message** action |
| Anti-malware | **Threat policies** > **Anti-malware** > policy > **Edit protection settings** | **Quarantine policy** |
| Safe Attachments (Defender) | **Threat policies** > **Safe Attachments** > policy > **Edit settings** | **Quarantine policy** under **Safe Attachments unknown malware response** |

Two traps:

- If you *change* a verdict to **Quarantine message**, the quarantine policy box is blank. Blank means the default policy for that verdict, not "no policy."
- Mail quarantined by an Exchange mail flow rule with **Deliver the message to the hosted quarantine** doesn't support quarantine policies, and Microsoft says those messages are available only to admins by default.

In PowerShell, use the `*QuarantineTag` parameters, for example:

```powershell
Set-HostedContentFilterPolicy -Identity "Default" -PhishSpamAction Quarantine `
  -PhishQuarantineTag "LimitedWithNotify"
```

Anti-phishing uses `SpoofQuarantineTag`, `TargetedUserQuarantineTag`, `TargetedDomainQuarantineTag` and `MailboxIntelligenceQuarantineTag`. See [anti-phishing policy settings](https://iblockspam.com/blog/microsoft-365-anti-phishing-policy-settings) for which verdicts those cover.

## What do quarantine notifications contain?

A notification lists each quarantined message with its **Sender**, **Subject** and **Date** (in UTC). The buttons depend on the quarantine policy ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-quarantine-notifications)):

- **Review message**: always present, and can't be removed by permissions.
- **Release**: with Full access, or the release permission. The message goes to the Inbox, subject to Inbox rules.
- **Request release**: with Limited access, or the request-release permission. By default, requests go to admins through the **User requested to release a quarantined message** alert policy.
- **Block Sender**: only with a custom policy that grants it. It adds the sender to the user's Blocked Senders list; it doesn't block the sender for the organization.

Delivery to groups follows a few rules. Messages to distribution groups or mail-enabled security groups notify every member. Microsoft 365 Groups notify members only if **Send copies of group conversations and events to group members** is on. Shared mailboxes notify only users with FullAccess permission.

## How do you set notification frequency, branding and languages?

These global settings apply to every quarantine policy with notifications on:

1. On the **Quarantine policies** page, select **Global settings** to open the **Quarantine notification settings** flyout.
2. **Choose language** first. Microsoft warns that values entered before you pick a language disappear.
3. Enter a **Sender display name**, **Subject** and **Disclaimer** (up to 200 characters) for that language, then select **Add**. Repeat for up to **three** languages. Each value must be unique per language.
4. **Specify sender address**: pick an existing internal user. The default sender is `quarantine@messaging.microsoft.com`.
5. **Use my company logo**: replaces the Microsoft logo. Upload it first in the Microsoft 365 organization theme; Microsoft says PNG or JPEG work best across Outlook versions.
6. **Send end-user spam notification every (days)**: **Within 4 hours**, **Daily** or **Weekly**.
7. Select **Save**.

A recognizable sender, logo and disclaimer help in practice. Attackers send fake quarantine notices, and our guide to [mailbox-full and account-suspended phishing](https://iblockspam.com/blog/mailbox-full-account-suspended-phishing) shows what those look like. Tell staff what the real one looks like, and that it never asks for a password.

## What's a sensible quarantine policy design?

This section is our recommendation, not a Microsoft default. For most small and mid-sized businesses:

1. **Spam, bulk and high confidence spam:** Full access with notifications, daily. Users can rescue newsletters and receipts themselves.
2. **Phishing, spoof and impersonation:** Limited access with notifications. Users see what was held and request release; an admin decides.
3. **High confidence phishing and malware:** AdminOnlyAccessPolicy. Users can't release these anyway.
4. Assign the policies in every anti-spam and anti-phishing policy, including custom ones; presets override custom policies for their users.
5. Review release requests at least daily, so requests don't pile up until users give up.

If you also run a filtering gateway with its own quarantine in front of Microsoft 365, users now have two places to look. Decide which one is primary and explain it once. iBlockSpam's [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests) gives each user a personal quarantine with scheduled digests, and our guide to [what an email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine) covers running one well.

## Next steps

- Run `Get-HostedContentFilterPolicy | Format-List Name,SpamAction,SpamQuarantineTag,PhishSpamAction,PhishQuarantineTag` and note which verdicts quarantine and with which policy.
- Replace DefaultFullAccessPolicy on phishing verdicts with a Limited access policy that notifies.
- Set notification frequency, sender, logo and disclaimer in the global settings, and show staff an example.
- Check that zero-hour auto purge is on, since it uses the same quarantine policies when it pulls messages after delivery. See [zero-hour auto purge (ZAP) in Microsoft 365](https://iblockspam.com/blog/microsoft-365-zero-hour-auto-purge-zap).

## Frequently asked questions

### Why don't users get quarantine notification emails in Microsoft 365?

Usually because the verdict uses AdminOnlyAccessPolicy or DefaultFullAccessPolicy, which both have notifications turned off. Notifications are on only in DefaultFullAccessWithNotificationPolicy, NotificationEnabledPolicy if your tenant has it, or a custom policy where you selected Enable. Assign one of those to the verdicts that quarantine mail.

### How often can Microsoft 365 send quarantine notifications?

The global setting Send end-user spam notification every (days) offers Within 4 hours, Daily or Weekly. Microsoft notes that with the four-hour option, a message quarantined just after a notification run can take slightly more than four hours to appear in the next notification.

### What is NotificationEnabledPolicy and why don't I have it?

It's a default quarantine policy with full access and notifications on. Microsoft only created it for organizations that existed before quarantine policies arrived in July to August 2021 and had end-user spam notifications turned on in an anti-spam policy. Newer tenants use DefaultFullAccessWithNotificationPolicy or a custom policy instead.

### Can quarantine notifications be customized with our logo and language?

Yes, in the global settings on the Quarantine policies page. You can choose an internal sender address, use the company logo from your Microsoft 365 organization theme, and set a custom sender display name, subject and disclaimer for up to three languages. Microsoft applies the customized values based on the language setting of each recipient's mailbox.

### Do quarantine notifications work for shared mailboxes?

Only partly. Microsoft says notifications for shared mailboxes are supported only for users with FullAccess permission to the mailbox, assigned directly or through a cloud-only security group. Quarantine management for shared mailboxes isn't supported with on-premises AD synchronized groups.

## Sources

- [Microsoft Learn: Quarantine policies](https://learn.microsoft.com/en-us/defender-office-365/quarantine-policies)
- [Microsoft Learn: Quarantine notifications in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/quarantine-quarantine-notifications)
- [Microsoft Learn: Recommendations for Microsoft 365 security settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)
- [Microsoft Learn: Configure spam filter policies](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure)
- [Microsoft Learn: Anti-phishing policies in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-quarantine-policies-notifications (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt