


You need to be assigned permissions before you can do the procedures in this article. To connect to standalone EOP PowerShell, see Connect to Exchange Online Protection PowerShell. To connect to Exchange Online PowerShell, see Connect to Exchange Online PowerShell.

To go directly to the Quarantine page, use. To open the Microsoft 365 Defender portal, go to.

What do you need to know before you begin? Watch this short video to learn how to manage quarantined messages as an admin. You view and manage quarantined messages in the Microsoft 365 Defender portal or in PowerShell (Exchange Online PowerShell for Microsoft 365 organizations with mailboxes in Exchange Online standalone EOP PowerShell for organizations without Exchange Online mailboxes). For more information about quarantine policies, see Anatomy of a quarantine policy.Īdmins and also users (depending on the user reported settings for the organization) can report false positives to Microsoft from quarantine. Users can manage most quarantined email messages based on the quarantine policy for supported email protection features. In Microsoft 365 organizations with mailboxes in Exchange Online or Microsoft Teams, or in standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes or Teams, quarantine holds potentially dangerous or unwanted messages that were detected by EOP and Defender for Office 365.Īdmins can view, release, and delete all types of quarantined messages and files for all users.Īdmins in organizations with Microsoft Defender for Office 365 can also manage files that were quarantined by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams and Microsoft Teams messages that were quarantined by zero-hour auto purge (ZAP) (currently in Preview).
