Why a quarantine matters
Every spam filter makes judgment calls. Most are right, but some legitimate messages look like spam, especially from new senders, newsletters you signed up for, or automated systems such as invoicing tools. A filter that silently deletes mail turns those mistakes into lost business.
A quarantine keeps suspected spam out of the inbox without throwing it away. The person it was addressed to can check it and release anything that's genuine.
Two kinds of quarantine
| Item | Personal quarantine | Shared domain quarantine |
|---|---|---|
| Who uses it | Every user on the domain | Admins |
| What it shows | Messages held for that user | Messages held for everyone on the domain |
| Typical use | Releasing a message you were expecting | Helping a colleague, checking patterns, handling leavers |
| Digest emails | Yes, on a schedule | Not needed; admins use the filtering panel, opened from the dashboard |
Personal quarantine
Every user gets their own quarantine, whatever your mailbox count. Because pricing is per domain with unlimited mailboxes, you don't have to choose which staff are "covered".
From the personal quarantine, a user can:
- see what was held, with sender, subject and date;
- release a legitimate message to their inbox;
- leave spam to expire.
Shared domain quarantine
Admins see everything held for the domain in one place. This helps when:
- someone is on leave and a supplier says they sent an invoice;
- a user isn't sure whether a message is a phishing attempt and asks IT;
- you want to spot a sender that's repeatedly held and add it to your allow list.
Digest emails
A digest is a summary email listing what's in a user's quarantine. It means people don't have to remember to log in.
Choosing a schedule
| Schedule | Good for |
|---|---|
| Hourly | Sales, support or anyone waiting on mail from new contacts |
| Daily | Most users |
| A chosen weekday | People who rarely get held mail and want one summary a week |
| Custom | Teams with specific working patterns |
Making digests work well
- Tell your team they're coming. A short internal note stops people treating the digest itself as suspicious.
- Explain what to release. Release mail you recognize or expected. If in doubt, ask an admin rather than releasing.
- Don't release to "test" a link. If a message looks like phishing, leave it held and report it.
Releasing safely
Releasing a message delivers it to the inbox. Before releasing, check:
- Do you know the sender? Look at the actual address, not only the display name.
- Were you expecting it? Unexpected invoices, password resets and shared files are common phishing themes.
- Does it ask for something urgent? Pressure to pay, log in or reply quickly is a warning sign.
If one legitimate sender keeps being held, an admin can add them to an allow list. Use sender verification so that spoofed mail claiming to be that sender isn't let through as well.
Message history
Alongside the quarantine, the filtering panel (opened from your dashboard) keeps 30 days of message history. When someone asks "did that email arrive?", you can look it up instead of guessing.
Related
Frequently asked questions
How often are digest emails sent?
You choose. Digests can be sent hourly, daily, on a chosen weekday, or on a custom schedule. Hourly suits people who are waiting on time-sensitive mail from new contacts. Daily or weekly suits most users, who only need to glance at what was held.
Can a user release their own messages?
Yes. Each user has a personal quarantine and can review and release messages held for them. Admins can also see the domain-wide shared quarantine, which is useful when someone is away or unsure whether a message is safe.
How long do quarantined messages stay available?
Message history covers 30 days. If a message is older than that, you'll need to ask the sender to resend it. If you're unsure about a held message, release it sooner rather than later.
Who can see what's in my quarantine?
You can see your own personal quarantine. Admins for your domain can see the shared domain quarantine. Our security page explains how we handle access and data.
Related guides
What is an email quarantine, and how should you use it?
What an email quarantine is, personal vs admin quarantine, digest emails, retention limits, and how to release messages without letting phishing back in.
8 min read Running email day to dayHow do you find and release quarantined email in Microsoft 365?
Find and release quarantined email in the Microsoft Defender portal as an admin or user, set quarantine policies and notifications, and use PowerShell safely.
9 min read Running email day to dayLegitimate email flagged as spam: why false positives happen and how to fix them safely
Why real business email gets quarantined or junked, how to release it safely, and how to allowlist senders without opening a door for spoofed mail.
8 min readLast updated: