# How do you find and release quarantined email in Microsoft 365?

URL: https://iblockspam.com/blog/release-quarantined-email-microsoft-365
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> Find and release quarantined email in the Microsoft Defender portal as an admin or user, set quarantine policies and notifications, and use PowerShell safely.

## Short answer

Open the Microsoft Defender portal at security.microsoft.com/quarantine, select the message on the Email tab and choose Release. Admins can release any message, including malware and high confidence phishing. Users can release only what their quarantine policy allows, and at most request release for high confidence phishing or malware. Check headers and the sender before releasing anything.

Microsoft 365 holds suspicious mail in a hosted quarantine instead of the user's mailbox. Getting a wrongly caught message out is quick once you know where to look. The harder part is releasing the right messages and not the phishing that was quarantined for a good reason.

This guide covers both admins and users, the policies that decide who can do what, and the checks to run before you click Release.

## Where is the quarantine in Microsoft 365?

Quarantine lives in the Microsoft Defender portal, for admins and users alike:

- **Path:** **Email & collaboration** > **Review** > **Quarantine**, then the **Email** tab.
- **Direct link:** `https://security.microsoft.com/quarantine?viewid=Email`

Admins see everything for everyone. Users signing in to the same page see only messages addressed to them, and only for the quarantine reasons their policies allow ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-end-user)).

Quarantined messages expire. Spam, bulk and phishing verdicts are kept for 15 days under the default anti-spam policy and 30 days under the Standard and Strict presets. Malware is kept for 30 days. After expiry, Microsoft says messages are "permanently deleted and can't be recovered" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-about)). Check the **Expires** column before you assume there's time.

## How do admins find a quarantined message?

1. Open the **Email** tab on the Quarantine page.
2. Select **Filter**. Useful filters are **Recipient address**, **Sender address**, **Subject**, **Time received** and **Quarantine reason** (Spam, Bulk, Phishing, High confidence phishing, Malware, Transport rule and others).
3. Remember that the **Search** box only searches the current view. To search everything, use **Filter** ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-admin-manage-messages-files)).
4. Select the row (not the check box) to open the details flyout. It shows the **Quarantine reason**, **Policy type**, **Expires** time and recipients.

## What should you check before releasing a quarantined email?

Releasing puts a message in front of a user who will assume it's safe. Spend a minute on these checks first.

1. **Read the quarantine reason.** Spam and bulk are low risk. Phishing, spoof and impersonation need more care. Malware and high confidence phishing should almost never be released.
2. **View the headers.** Select **More** > **View message headers** and copy them into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). Look at `Authentication-Results` for SPF, DKIM and DMARC. A known sender that fails all three is a red flag.
3. **Preview without risk.** **Preview message** shows the body as source or plain text, with links disabled. Check where links really point.
4. **Confirm out of band.** If the message asks for a payment, a password or a bank change, call the sender on a number you already have. Don't use details from the message itself.
5. **Look for siblings.** Filter by sender. If the same message went to many people, decide once for all of them.

Our guide to [false positives](https://iblockspam.com/blog/false-positives-legitimate-email-flagged) explains what usually causes good mail to be caught.

## How do admins release a message?

1. Select the message, then **Release** on the Email tab, or **Release email** in the details flyout.
2. In **Release email to recipient inboxes**, choose the options you need:
   - **Send a copy of this message to other recipients**, for example to yourself for a closer look.
   - **Submit the message to Microsoft to improve detection (false positive)**, so Microsoft can learn from the mistake.
   - **Allow this message**, which appears once you choose to submit. It adds Tenant Allow/Block List allow entries for the sender and any related URLs or attachments. The default expiry is **45 days after last used date**.
3. Select **Release message**. The **Release status** changes to **Released**.

A few rules apply ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-admin-manage-messages-files)):

- You can't release a message to the same recipient more than once.
- Released mail is redelivered, so it shows the release time in Outlook. The original send date stays in the headers.
- Inbox rules can still move or delete the released message. Use message trace to confirm delivery.
- If another filter sits in your mail path, Microsoft notes a released message can be quarantined again or never arrive. Check that layer too.

Use **Allow this message** sparingly. An allow entry is a standing exception, not just a release. Our guide to [whitelisting senders safely](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace) covers the risks.

## What can users release themselves?

By default, users can view, release and delete their own messages quarantined as bulk, spam, high confidence spam, phishing, spoof and impersonation. They can't see messages quarantined as high confidence phishing, malware, or by mail flow rules. Those are admin only ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-end-user)).

For users, the steps are:

1. Go to `https://security.microsoft.com/quarantine?viewid=Email` and sign in with your work account.
2. Select the message, then **Release** (or **Release email** in the flyout).
3. Optionally select **Report message as having no threats**, then **Release message**.

If **Release** is greyed out, Microsoft says that's expected: the quarantine reason or policy doesn't allow it. The user can choose **Request release** instead, if the policy permits, and an admin approves or denies it.

### Approving release requests

Filter the Email tab by **Release status** > **Release requested**. Select a message, run the checks above, then choose **Release** to approve or **Deny** to refuse. Denied messages show the status **Denied**.

## How do quarantine policies control what users can do?

Each verdict in your anti-spam, anti-phishing and anti-malware policies is assigned a quarantine policy. The policy sets the user's permissions and whether they get notifications ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-policies)).

| Default quarantine policy | Permission group | Notifications |
|---|---|---|
| AdminOnlyAccessPolicy | No access | No |
| DefaultFullAccessPolicy | Full access | No |
| DefaultFullAccessWithNotificationPolicy | Full access | Yes |
| NotificationEnabledPolicy (older tenants only) | Full access | Yes |

What the permission groups allow:

- **No access:** the user can only view message headers, if the message is visible at all.
- **Limited access:** preview, delete, allow sender and **request** release, but not release directly.
- **Full access:** preview, delete, allow sender and release.

Even with Full access, Microsoft doesn't honor the release permission for malware or high confidence phishing. Users can only request release for those.

### Turning on quarantine notifications

The default anti-spam policy assigns DefaultFullAccessPolicy to spam, high confidence spam, phishing and bulk, and that policy has notifications turned off. That matters once you change those actions to quarantine (or use a custom policy that does): users can't release what they don't know about. To fix that:

1. Go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Quarantine policies** in the **Rules** section (`https://security.microsoft.com/quarantinePolicies`).
2. Create a custom policy, or use DefaultFullAccessWithNotificationPolicy. For high-risk verdicts such as phishing, consider **Limited access** so users request release instead of releasing directly.
3. Assign it to the verdicts in your anti-spam and anti-phishing policies.
4. Select **Global settings** and set **Send end-user spam notification every (days)** to **Within 4 hours**, **Daily** or **Weekly**. You can also set the sender address, a company logo and per-language text.

The Standard and Strict preset policies already use DefaultFullAccessWithNotificationPolicy for several verdicts.

## How do you release quarantined email with PowerShell?

PowerShell is useful for bulk work or when the portal is slow. Connect to Exchange Online PowerShell, then find the message:

```powershell
Get-QuarantineMessage -RecipientAddress julia@contoso.com `
    -SenderAddress billing@supplier.example
```

Other filters include `-QuarantineTypes` (such as `Spam`, `Phish`, `HighConfPhish`, `Malware`), `-ReleaseStatus`, `-Subject` and `-StartReceivedDate` / `-EndReceivedDate` ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-quarantinemessage?view=exchange-ps)).

Release to the original recipient by piping the result, or by Identity:

```powershell
Get-QuarantineMessage `
    -MessageID "<5c695d7e-6642-4681-a4b0-9e7a86613cb7@contoso.com>" |
    Release-QuarantineMessage -User julia@contoso.com

Release-QuarantineMessage -Identity <GUID1\GUID2> -ReleaseToAll
```

Know these switches before you use them ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/release-quarantinemessage?view=exchange-ps)):

- `-ReleaseToAll` releases to all original recipients. You can't combine it with `-User`.
- `-ReportFalsePositive` reports the message to Microsoft. It's available only for quarantined spam.
- `-AllowSender` stops future messages from that sender being quarantined. Use it rarely.
- `-Force` is needed to re-release a message that was released before.

Never run `Get-QuarantineMessage | Release-QuarantineMessage -ReleaseToAll` without filters. It releases every message the query returns (by default, up to 100 from the last 16 days), phishing included.

## When is a per-user quarantine outside Microsoft 365 useful?

Microsoft's quarantine works well once policies and notifications are set. Some businesses also run a filtering gateway in front of Microsoft 365 with its own quarantine. With iBlockSpam, for example, each user gets a personal quarantine with scheduled digest emails, and admins get a domain-wide shared quarantine. See [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests) for how that works.

If you run two layers, remember each has its own quarantine. A message missing from Microsoft's quarantine may be held in the gateway's, and the other way round. Shared mailboxes need extra planning, because their accounts should have sign-in blocked; see [shared mailbox spam protection](https://iblockspam.com/blog/shared-mailbox-spam-protection).

## Next steps

1. Check which quarantine policy each verdict uses, and turn on notifications for spam and bulk at least.
2. Keep high confidence phishing and malware admin only.
3. Write a short release checklist for your helpdesk based on the five checks above.
4. Read [what an email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine) for the wider picture, and [how to stop phishing in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365) to reduce what ends up there.

If you filter mail with iBlockSpam instead, each user gets a personal quarantine with digests; the [portal demo](https://iblockspam.com/demo) shows held-mail counts per domain with sample data.

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Why is the Release button greyed out in Microsoft 365 quarantine?

Microsoft calls this expected behavior. Either the message was quarantined for a reason users can't release, such as malware or high confidence phishing, or the quarantine policy for that verdict doesn't give users release rights. The user can request release if the policy allows it, or an admin can release it.

### How do I approve a quarantine release request in Microsoft 365?

On the Quarantine page's Email tab, filter Release status to Release requested. Select the message, check its headers and preview, then choose Release to approve or Deny to refuse. Approving opens the same release flyout as a normal admin release, with the same options.

### Can anyone release a message quarantined as high confidence phishing?

Only admins. Microsoft doesn't let recipients release high confidence phishing, malware, or Safe Attachments detections, whatever the quarantine policy says. If the policy allows release, users can only request it. Treat these requests with suspicion and check the message carefully before approving.

### How do I turn on quarantine notification emails for users?

Assign a quarantine policy with notifications enabled, such as DefaultFullAccessWithNotificationPolicy or a custom policy, to the verdicts in your anti-spam and anti-phishing policies. Then set the frequency, either within 4 hours, daily or weekly, under Global settings on the Quarantine policies page.

### Why can't a user find an email after it was released from quarantine?

Released mail is redelivered, so it appears with the release time rather than the original time and may sit lower or higher than expected. Inbox rules can also move it. If it still isn't there, use message trace to confirm delivery, and check whether another filter in the path caught it again.

## Sources

- [Microsoft Learn: Manage quarantined messages and files as an admin](https://learn.microsoft.com/en-us/defender-office-365/quarantine-admin-manage-messages-files)
- [Microsoft Learn: Find and release quarantined messages as a user](https://learn.microsoft.com/en-us/defender-office-365/quarantine-end-user)
- [Microsoft Learn: Quarantine policies](https://learn.microsoft.com/en-us/defender-office-365/quarantine-policies)
- [Microsoft Learn: Quarantined email messages in cloud organizations](https://learn.microsoft.com/en-us/defender-office-365/quarantine-about)
- [Microsoft Learn: Get-QuarantineMessage](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-quarantinemessage?view=exchange-ps)
- [Microsoft Learn: Release-QuarantineMessage](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/release-quarantinemessage?view=exchange-ps)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/release-quarantined-email-microsoft-365 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt