Email Advanced Threat Protection Quarantine Policies: Microsoft 365 Design and Administration Guide for Security Teams

Key takeaways

• Email advanced threat protection quarantine policies decide what recipients can do with isolated messages, while separate detection policies decide which messages reach quarantine
• Under email advanced threat protection quarantine policies, malware, Safe Attachments malware or phishing verdicts and high-confidence phishing stay under administrator control even when a policy grants recipients full access
• Scoping email advanced threat protection quarantine policies by role gives finance, payroll and executive mailboxes stricter release paths than lower-risk mailboxes
• Well-governed email advanced threat protection quarantine policies record a reviewer, business reason and audit trail for every release, deletion and exception
• When email advanced threat protection quarantine policies isolate one phishing message, analysts should scope recipients, URLs and attachment hashes before deleting any evidence
• Cybersecurity awareness training teaches employees to recognize spoofed quarantine notices, report uncertainty and avoid unsafe release requests.

Want more from Adaptive in your Google results?

According to Verizon's 2026 Data Breach Investigations Report, 62% of confirmed breaches involve a human element. Email advanced threat protection quarantine policies determine whether a suspicious message waits in a controlled holding area or lands in front of an employee. When those policies are loosely scoped, a recipient can release a convincing invoice, a spoofed quarantine notice can harvest credentials, and security teams lose the evidence needed to trace the campaign.

Microsoft 365 separates user and administrator workflows, so a quarantined message differs from a deleted one and a release request carries no authority to bypass protection. Safe Attachments adds further complexity by handling malicious, encrypted and unscannable files differently under its Block and Dynamic Delivery actions.

Configuring these controls correctly reduces exposure while giving employees a clear way to recognize suspicious notifications and report phishing. This email advanced threat protection quarantine policies guide covers:

• How email advanced threat protection quarantine policies separate detection verdicts, recipient scope and permissions;
• Which spam, phishing, impersonation, malware and Safe Attachments verdicts trigger quarantine under email advanced threat protection quarantine policies;
• How administrators create, assign, test and audit custom email advanced threat protection quarantine policies in the Microsoft Defender portal and Exchange Online PowerShell;
• How security teams investigate campaigns, document releases and measure whether email advanced threat protection quarantine policies are working;
• How cybersecurity awareness training prepares employees to handle quarantine notifications and release requests safely.

Quarantine controls stop dangerous messages before delivery, yet cyberattackers target the employees who read notifications and request releases. Adaptive Security connects email detection, employee reporting and targeted coaching.

Book a demo

What Are Email Advanced Threat Protection Quarantine Policies?

Email advanced threat protection quarantine policies, delivered in Microsoft 365 through Microsoft Defender for Office 365, determine how suspicious or harmful messages are isolated rather than delivered to user inboxes. They preserve a controlled path for review, release, reporting and investigation while preventing recipients from interacting with messages that carry dangerous verdicts. Quarantine is a governed holding state that differs from deletion, and its behavior depends on the detection verdict, recipient scope and assigned permissions.

According to the European Union Agency for Cybersecurity's ENISA Threat Landscape 2025, phishing was the leading initial intrusion vector, accounting for about 60% of observed cases. That share shows why quarantine design deserves the same scrutiny as detection tuning, because phishing is the most common way intrusions begin.

How Does the Architecture of Email Advanced Threat Protection Quarantine Policies Work?

Email advanced threat protection quarantine policies separate three decisions that administrators often combine. The detection policy evaluates a message, the quarantine policy determines what users and administrators can do with it and recipient scope defines which people or groups receive those controls. Separating these decisions lets security teams apply stricter handling to finance, payroll, executive and accounts-payable teams without imposing the same workflow on every employee.

The detection layer evaluates signals such as sender reputation, authentication results, links, attachments, impersonation indicators, malware behavior and message patterns. It assigns a verdict such as spam, bulk email, phishing, high-confidence phishing or malware. That verdict determines whether the message is rejected, delivered to the Junk Email folder, redirected or placed in quarantine.

The quarantine policy applies after the detection policy selects isolation. It defines whether recipients can preview a message, release it, request its release, delete it or report it as legitimate, and it controls whether users receive quarantine notifications. A policy that permits users to release routine spam should never grant the same authority for malware or high-confidence phishing, where an incorrect release exposes an employee to the original cyberattack.

Recipient scope establishes the governance boundary. Administrators can apply controls broadly or target specific users, groups, domains or cyber threat categories. A practical design gives high-risk teams a restricted review path while allowing lower-risk users to manage routine spam within defined limits.

This layered architecture also supports investigation. Authorized reviewers can search quarantined messages, inspect message details, compare repeated campaigns and identify targeted recipients before releasing or deleting items. The same record that keeps a message out of the inbox also holds the evidence needed to understand the cyberattack.

Organizations that also handle employee-reported messages can connect quarantine operations with a broader phish triage and phishing response workflow. A filtered message and an employee-reported message represent two parts of the same human-risk signal: one shows what the control detected, and the other shows whether an employee recognized and escalated the cyber threat.

What Is the Email Message Quarantine Lifecycle Under Email Advanced Threat Protection Quarantine Policies?

The lifecycle starts when an inbound message enters mail flow and threat detection evaluates its sender, destination, content and behavior. If Microsoft 365 assigns a verdict that requires isolation, it moves the message into quarantine instead of delivering it to the recipient's inbox. The recipient therefore has no way to interact with the original message from the mailbox.

Policy-controlled access follows isolation. A notification can identify the sender, subject, date and quarantine reason without exposing the full message or its attachments. Depending on the verdict and assigned policy, the user can request release, release the message directly, delete it or report it as legitimate, while malware and high-confidence phishing may appear without any release option.

Release is a security decision, and the administrator workflow later in this guide covers it in detail. Even a message that looks safe in isolation can belong to a coordinated spear phishing campaign, so releasing one copy without checking related messages can leave other mailboxes exposed.

Quarantine differs from mailbox deletion at every stage:

• Quarantine keeps a message in a restricted service location for a defined period and supports controlled review;
• Mailbox deletion removes a delivered copy from the recipient's mailbox and is typically a remediation action;
• Permanent deletion removes the quarantined item so no one can release or examine it through the quarantine interface.

That distinction affects incident response. If a malicious message reaches an inbox, deleting the copy limits further exposure, but investigators might still need message headers, URLs, attachment details and recipient information. If the message was quarantined before delivery, its record supports investigation without requiring analysts to recover it from a user mailbox.

Quarantine retention is finite, and expired items are permanently deleted with no recoverable folder as a fallback. Manual deletion can also remove an item before normal expiration, so teams should record essential investigation details before approving permanent deletion.

Where Can Users and Administrators Access Quarantined Items?

Users and administrators reach quarantine through different paths because they carry different responsibilities. End users typically reach permitted items through notification messages or the user-facing quarantine page in the Microsoft Defender portal. Available actions depend on the assigned policy, so one employee can see different controls for messages with different verdicts.

Administrators and authorized reviewers use the administrative quarantine view to search and inspect items across the organization. They can filter by recipient, sender, subject, message identifier, verdict, date and quarantine reason. Their available actions depend on role permissions and can include releasing a message, releasing it to selected recipients, deleting it, reporting a false positive or starting a follow-up investigation.

Role-based access control keeps review separate from high-risk release authority, and the audit and permissions step later in this guide expands on that principle. The most reliable operating model treats quarantine as an owned review queue where users report uncertainty, analysts validate the message and related campaign signals and administrators tune policies when recurring false positives or missed cyber threats expose a gap. That feedback loop turns isolated messages into actionable human-risk signals before cyberattackers can repeat the campaign.

Single quarantined messages often belong to wider campaigns that already reached other inboxes. Adaptive Security quarantines email across every affected mailbox and explains each verdict with a confidence score.

Explore the platform

Which Detections Send Email to Quarantine Under Email Advanced Threat Protection Quarantine Policies?

Email advanced threat protection quarantine policies separate what a message was detected as from what happens after detection. A detection verdict identifies the risk, while the policy action determines whether the message is rejected, delivered to junk, quarantined or delivered with a warning. Anti-spam verdicts can balance user access against false-positive risk, but high-confidence phishing, malware and dangerous attachments require restricted handling.

According to Verizon's 2026 Data Breach Investigations Report, phishing served as the initial access vector in 16% of breaches. Verdict design determines how many of those messages employees ever see, because each detection category maps to a different default action and permission level.

How Do Email Advanced Threat Protection Quarantine Policies Handle Anti-Spam and Bulk Verdicts?

Anti-spam systems classify messages by confidence and delivery risk. Spam typically routes to the Junk Email folder or quarantine because the message is unwanted but not necessarily malicious. High-confidence spam receives a stronger verdict when multiple signals indicate a greater likelihood of abuse, evasion or user deception.

Bulk mail, sometimes called gray mail, includes newsletters, marketing campaigns and automated notifications. Because bulk mail is often legitimate, organizations commonly route it to junk or quarantine rather than blocking it outright. A finance department may need vendor notices delivered reliably, while a sales team may accept stricter filtering for unsolicited campaigns.

Policy actions and quarantine permissions remain separate controls. An anti-spam policy can quarantine high-confidence spam, while the quarantine policy determines whether users can release those messages, request release or only view message metadata. That separation prevents a recipient from overriding a severe verdict simply because a message appears familiar.

The following table summarizes a starting model for each verdict, including user access and investigation priority.

Each tenant should adapt this model to its own risk tolerance. Sending every bulk message to administrator review creates unnecessary workload, while allowing users to release phishing without review removes the value of the verdict. Administrators should document which verdicts permit recipient action and which require security-team approval.

How Do Email Advanced Threat Protection Quarantine Policies Handle Anti-Phishing and Impersonation Verdicts?

Anti-phishing verdicts address messages crafted to manipulate trust, steal credentials or redirect payments. Phishing usually indicates suspicious content, sender behavior, authentication failure or a deceptive link, while high-confidence phishing means the combined evidence crosses a more serious threshold. These messages belong under administrator control because the cost of a false negative far exceeds the inconvenience of a false positive.

According to the European Union Agency for Cybersecurity's ENISA Threat Landscape 2025, AI-supported phishing campaigns reportedly represented more than 80% of observed social engineering activity worldwide by early 2025. Polished grammar and convincing branding now offer weaker warning signs than they once did, which raises the importance of authentication and identity signals in each verdict.

Spoofing and impersonation are related but distinct. Spoofing generally involves falsifying the visible sender, domain, reply path or authentication identity. Impersonation targets a trusted person or organization, such as a chief executive, payroll provider, customer or supplier, and it can pass basic authentication checks when a cyberattacker uses a lookalike domain or compromised legitimate account.

High-risk recipients require stricter policy treatment. Finance, payroll, procurement, executive assistants and administrators routinely handle payment instructions, credentials and sensitive documents, so their impersonation verdicts should route to quarantine or require security review. Recognizing a display name should never unlock a release, since familiarity is exactly what cyberattackers exploit to suppress suspicion.

A secure configuration also accounts for post-delivery detection. Zero-hour auto purge (ZAP) can move a delivered message into quarantine when new reputation, URL or campaign signals emerge after initial scanning. Analysts should then extend the investigation to recipient clicks and similar messages across the organization.

Employees need a clear reporting path more than they need release authority. A phishing response workflow can classify reported messages, support reversible remediation and route uncertain cases to analysts. Employees remain an essential detection layer when reporting is fast and psychologically safe, while the security team retains control over verdicts tied to credential theft, executive impersonation and payment fraud.

How Do Email Advanced Threat Protection Quarantine Policies Handle Malware and Attachment Verdicts?

Malware verdicts require the strictest quarantine treatment because a message can carry code that steals data, encrypts files, establishes persistence or enables follow-on compromise. Malicious attachments include executable files, weaponized documents, scripts, archives and files whose behavior changes after opening. An attachment can also become dangerous when it contains a link to a payload rather than the payload itself.

Malicious URLs carry equivalent priority. A URL can lead to a credential-harvesting page, drive-by download, fake cloud login or compromised legitimate site, and cyberattackers can activate or redirect links after messages pass initial scanning. If a user has already clicked, the investigation must include the account, session, device and any submitted credentials.

According to Verizon's 2026 Data Breach Investigations Report, stolen credentials were involved in 39% of breaches across the full attack chain. A quarantined credential-harvesting link should therefore trigger a sign-in review for every recipient who may have clicked a related copy.

Payload verdicts call for administrator analysis, sandboxing, sender verification and a campaign-wide search, even when a recipient expects an invoice or document. Security teams should also remove related messages from other inboxes and review endpoint activity when the verdict indicates a likely payload. When verdict actions and permission assignments are tested together with controlled messages, an expected invoice that carries a payload stays in quarantine instead of reaching accounts payable.

Native verdicts can classify impersonation and payment-fraud emails as safe. Adaptive Security's AI-native Cloud Email Security catches those messages and layers onto Microsoft 365 without mail-flow changes.

Book a demo

What Should Cybersecurity Awareness Training Teach Users About Email Advanced Threat Protection Quarantine Policies?

Cybersecurity awareness training should teach employees what they can do with quarantined messages without bypassing protective controls. Under email advanced threat protection quarantine policies, Microsoft Defender determines whether an end user can inspect, delete, release or escalate a message. Microsoft groups those actions into three preset permission levels, compared in the table below.

Quarantine permissions decide how much human error reaches the release button, so the permission model and the training content need to match.

How Do No Access, Limited Access and Full Access Permissions Compare?

The permission level applies only to a recipient's own quarantined messages. Administrators assign the quarantine policy to the detection that triggered quarantine, so the same user can have different actions available for spam, phishing, malware and password-protected attachments. Microsoft's quarantine policy permission reference identifies three preset groups and the individual actions included in each one.

The table below compares the actions each preset permission group allows.

No access is the strictest setting. When quarantine notifications are disabled, users do not see the message in the quarantine portal and receive no notification. When notifications are enabled, users can see that a message exists, but their only available action is to view its headers, which gives security teams visibility without exposing content or creating a release path.

Limited access is the controlled-review setting. Users can search for a quarantined message, preview the body, inspect headers, delete the message, add the sender to Safe Senders or request administrator review. An administrator must approve the request before the message reaches the mailbox.

Full access provides the fastest workflow for eligible detections. Users can perform the same inspection, deletion and Safe Senders actions as Limited access users, then select Release to deliver the message. Release redelivers the message, so the mailbox can show a new delivery timestamp while the original send time remains in the headers.

Blocked Senders requires separate configuration. If an administrator enables the Block sender permission in a custom policy, the user can add the sender to the mailbox's Blocked Senders list. That action affects only the individual mailbox, so later messages may still reach Junk Email or quarantine depending on policy precedence, and blocking delivery organization-wide requires an administrator-controlled mail flow rule or Tenant Allow/Block List entry.

How Should Users Safely Review and Release a Quarantined Message?

Safe review begins in the Microsoft Defender portal under Email & collaboration > Review > Quarantine, on the Email tab. Users can search by sender address or subject, then filter by recipient, time received, expiration date, quarantine reason, release status and policy type. Selecting a message opens details such as the sender, recipient, subject, quarantine reason, policy type, receipt time, expiration time and network message ID.

Previewing content should come before any release decision. The preview provides an HTML view with links disabled and a plain-text view, so the user can evaluate the message without activating embedded links. Viewing headers adds authentication results, routing information and the complete recipient list, which helps security teams distinguish a legitimate vendor message from a spoofed sender or lookalike domain.

Reporting is the safest user action when a message is suspicious. Deleting removes the message from quarantine permanently, so employees should delete only clearly unwanted spam. Employees should report an unexpected invoice, credential request, executive instruction or attachment to the security team instead of releasing it because the sender name looks familiar.

Release and request release serve different control models. Full access users should select Release only after validating the sender, context, links and attachment expectations, while Limited access users select Request release and wait for administrator approval. High-impact requests require verification through a separate trusted channel, such as a known phone number or established internal chat, because a convincing display name does not establish authenticity.

Adding a sender to Safe Senders should be a deliberate exception. The action adds the sender to the user's mailbox Safe Senders list and can influence future filtering for that mailbox, yet organizational protections such as malware and high-confidence phishing verdicts still apply. Employees should never use it for a sender associated with suspicious domains, unexpected payment instructions or unrequested files.

Why Can't Users Release Malware or High-Confidence Phishing?

Recipients cannot directly release three categories of messages, regardless of how the quarantine policy is configured, because each verdict indicates a payload-level or high-confidence cyber threat:

• Messages that anti-malware policies quarantine as malware,
• Messages that Safe Attachments policies quarantine as malware or phishing,
• Messages that anti-spam policies quarantine as high-confidence phishing.

When the assigned quarantine policy grants release permission for these verdicts, Microsoft treats it as a release request, so an administrator must approve delivery. Allowing a recipient to override a payload-level verdict would give every mailbox a private bypass around malicious-content controls.

This separation keeps a high-consequence decision away from an employee working under pressure. A message that appears to come from a finance leader, supplier or executive assistant can still contain a malicious attachment or credential-harvesting link. The correct action is to preserve the evidence, report the message and let a trained reviewer validate the verdict.

How Should Users Handle Password-Protected Attachments?

Password-protected attachments need a separate review path because encryption prevents Safe Attachments from scanning the file contents. The message appears with the quarantine reason Password protected item, and the user must open it in the Defender portal to act on it.

If the message is expected and the sender is independently validated, the user can select Release email and enter the attachment password when prompted, provided the quarantine policy allows it. Microsoft uses that password to open and rescan the attachment before delivery and does not store it. If the scan finds malware or the file remains unscannable, the message stays in quarantine for administrator review.

Users should enter only the attachment password, never an account, banking or email password. An unexpected password-protected invoice, résumé, contract or shipping document is a warning signal because cyberattackers use encryption to conceal malware from automated inspection. When the sender or context cannot be verified, deleting the message or requesting security review keeps quarantine a controlled inspection point.

When an employee releases a convincing invoice from quarantine without verification, the control fails at its final step. Adaptive Security trains employees to pause, verify through trusted channels and report.

Take a self-guided tour

How Do Administrators Create and Assign Custom Email Advanced Threat Protection Quarantine Policies?

Custom email advanced threat protection quarantine policies are created in the Microsoft Defender portal, where administrators define what recipients can do with quarantined messages and whether they receive notifications. Each policy then needs an assignment to the relevant anti-spam, anti-phishing, anti-malware or Safe Attachments verdicts, followed by a review of recipient scope, exceptions and policy precedence. Release permissions represent a risk decision, and excessive user access weakens protection against convincing cyber threats.

1. Design Email Advanced Threat Protection Quarantine Policies Around the Verdict

A quarantine policy controls the recipient experience after Microsoft 365 quarantines a message, while the protection policy determines whether the message is spam, phishing, malware or an unsafe attachment. The quarantine policy then governs whether the recipient can view, preview, delete, release or request release of the message.

Security teams should separate policies by risk and audience. High-confidence phishing and malware verdicts call for restricted access, while lower-confidence spam or bulk mail can use a controlled review workflow. This approach keeps employees from releasing messages that security controls identify as serious cyber threats while preserving a recovery path for legitimate business mail.

The No access, Limited access and Full access presets compared earlier cover most needs. When a preset does not fit the organization's risk model, Set specific access (Advanced) lets administrators choose between request release and direct release and separately enable Delete, Preview, Block sender and Allow sender. Each policy should use either direct release or administrator-approved release, never both.

The verdict-level release restrictions described in the user section still apply to every custom policy, so recipients with Full access receive only a request-release workflow for malware and high-confidence phishing. Microsoft's quarantine policy guidance explains how each permission operates in the quarantine portal and notification email.

2. Configure the Custom Policy in the Microsoft Defender Portal

Administrators open https://security.microsoft.com and go to Email & collaboration > Policies & rules > Threat policies > Quarantine policy under Rules. After selecting Add custom policy, they enter a unique name and select Next. Names that identify the access level and intended scope, such as Finance-Limited-Notifications or HighRisk-NoAccess, prevent confusion during incident response in a way that generic names such as Policy1 cannot.

On the Recipient message access page, Limited access supports a controlled review process, while Set specific access (Advanced) provides granular permissions. Allowing recipients to preview and delete messages while requiring administrator approval for release offers a controlled operating model for many organizations. Allow sender adds the sender to the recipient's Safe Senders list, so administrators should enable it only when the business accepts that mailbox-level trust change.

On the Quarantine notification page, selecting Enable sends recipients periodic messages about quarantined items, with an option to include messages quarantined because of blocked senders. Notifications inform employees that messages exist in quarantine, while available actions still follow the permissions selected under recipient access. For sensitive verdicts, notification-only access provides visibility without creating a delivery path.

After reviewing every setting, the administrator selects Submit and Done, then opens the new policy from the list to confirm its access and notification settings. Global settings on the quarantine policies page control the notification sender name, subject, disclaimer, language, branding and frequency, and they apply only when the assigned quarantine policy has notifications enabled. The new policy affects no messages until administrators attach it to each protection policy and verdict that requires different behavior.

3. Assign the Policy to Detections and Define Recipient Scope

The custom policy is assigned within the protection policy that performs the quarantine action. The assignment applies only when the selected verdict is configured to Quarantine message, so a verdict set to deliver, move to Junk or block without quarantine ignores the quarantine policy entirely. Each protection family has its own assignment location:

• Anti-spam: Under Threat policies > Anti-spam, administrators open an inbound policy, select Edit actions and assign the custom policy to spam, high-confidence spam, phishing, high-confidence phishing or bulk verdicts that use quarantine, where a blank field means Microsoft applies the default policy;
• Anti-phishing: Under Threat policies > Anti-phishing, administrators edit the relevant policy, open Actions and assign the custom policy to spoofing, user impersonation, domain impersonation or mailbox intelligence verdicts, which requires the relevant protection feature to be enabled and set to quarantine;
• Anti-malware: Under Threat policies > Anti-malware, administrators edit Protection settings and select the custom policy under Quarantine policy, although recipients still cannot directly release anti-malware detections;
• Safe Attachments: Under Threat policies > Safe Attachments, administrators edit the policy's Settings and assign the custom policy under Safe Attachments unknown malware response, and malware and phishing detections remain subject to administrator-release restrictions.

Recipient conditions determine which messages enter each protection policy. Administrators define recipients, groups or domains in the Users, Groups or Domains fields of the policy's rule, where conditions of different types combine with AND logic and multiple values within one condition combine with OR logic. A rule containing the Finance group and the owned domain therefore applies only to finance recipients in that domain, while listing both the Finance and Executive groups applies the policy to either audience.

Exceptions remove recipients, groups or domains from a policy that would otherwise match them, and an exception takes precedence over a matching condition within that rule. Overlapping rules with contradictory quarantine policies create a related risk, because a higher-priority rule can govern a message before an administrator identifies the conflict. Recipients then hold permissions that do not match the intended risk level.

4. Review Precedence, Built-In Settings and Cleanup

Policy precedence determines which protection policy applies when multiple policies match the same recipient. Microsoft evaluates the Strict preset security policy first, then the Standard preset, then custom policies in priority order and finally the default policy, as its email protection precedence guidance explains. Narrowly scoped custom policies belong above broad organization-wide policies, and the default policy should cover only recipients who match no custom rule.

Recipients covered by the Standard or Strict preset security policies receive the preset's detection settings and quarantine assignments before any custom policy is evaluated. A custom quarantine policy attached to a custom protection policy therefore never reaches those recipients. Administrators who need different quarantine behavior for a group should first confirm which preset, if any, already includes it.

Built-in quarantine policies are read-only, so organizations that need a different combination of access and notification settings create a custom policy instead:

• AdminOnlyAccessPolicy provides no end-user access and disables notifications;
• DefaultFullAccessPolicy provides full access without notifications;
• DefaultFullAccessWithNotificationPolicy provides full access with notifications;
• NotificationEnabledPolicy, present in some older tenants, reflects legacy notification behavior.

Before deleting an unused custom policy, administrators should identify every protection policy that references it through a PowerShell inventory or a review of each protection-policy family in the portal. After replacing every active reference, they return to Threat policies > Quarantine policy, select the unused policy, choose Delete policy and confirm Remove policy.

A final check with one recipient in each intended scope, one excluded recipient and each high-risk verdict confirms the assigned quarantine policy, notification behavior, release path and audit record before broad deployment. A passing check shows, for example, that a finance approver receives only a release-request option for a spoofed invoice while a standard employee can still recover a misfiled newsletter.

How Should Administrators Manage Email Advanced Threat Protection Quarantine Policies?

Administrators should manage email advanced threat protection quarantine policies as evidence-handling workflows. Effective handling means locating the message, validating its indicators and investigating related activity before any release, deletion or submission for analysis. Role-based approvals, message tracing, documented decisions and auditable evidence keep each action defensible, and even a released message still requires verification of downstream scanning, transport rules and user notification.

According to IBM's Cost of a Data Breach Report 2026, phishing remained the top initial attack vector for the fourth consecutive year, with voice and SMS phishing (vishing/smishing) involved in 17% of breaches and carrying the highest average breach cost. Each release decision is therefore a small breach-prevention decision, and the steps below keep those decisions consistent across analysts.

1. Locate and Filter the Quarantined Message

Analysts should begin in the Microsoft Defender quarantine view and filter before opening individual messages. Useful filters include recipient, sender, subject, quarantine reason, detection type, received date, message ID and release-request status. A suspicious message often belongs to a broader campaign affecting multiple recipients, so narrowing the result set protects the investigation from incomplete context.

The complete message identifier provides a more reliable reference than the subject line. Subjects can be duplicated, altered or localized, while the message ID or network message ID stays stable across searches. Before taking action, the analyst records the sender, recipients, delivery timestamp, originating IP address, authentication results, policy action and quarantine location.

Previewing the message without releasing it lets the analyst look for credential prompts, payment instructions, unexpected file-sharing links, QR codes or requests to bypass normal approval procedures. The preview is an examination surface and offers no proof of safety, because remote content can change and a harmless-looking page can redirect after delivery.

Full headers need review before any decision. The analyst compares the visible From address with the envelope sender, Reply-To field, Return-Path, authentication results, received path, originating infrastructure and mail-system warnings. Header anomalies can reveal impersonation, unusual routing, failed authentication and infrastructure shared across multiple messages, even when they fall short of proving malicious intent.

The analyst then records the initial verdict and confidence level and compares it with the business context. A vendor invoice, executive request, password reset or urgent wire-transfer instruction warrants heightened scrutiny even when the message passes basic authentication checks. Business email compromise (BEC) often relies on trusted-looking identity and timing rather than malware.

2. Approve, Deny, Release or Delete With Control

An authorized reviewer releases a message only after confirming its legitimacy and business need. A release request should identify the message, intended recipients, reason for release, reviewer, approval time and any compensating action. For example, an administrator might approve a blocked contract after confirming the sender through a known telephone number and obtaining a second reviewer's signoff.

Three conditions justify denial: an unverifiable sender, suspicious links or attachments and a request that relies on urgency and authority without normal business context. Deletion fits when the verdict is malicious and the organization has preserved the evidence needed for investigation. A message that could support an incident review should stay in quarantine until the investigation concludes.

Release leaves subsequent controls in place. Redelivery can still trigger transport rules, mailbox policies, post-delivery scanning, user-reporting workflows or remediation actions, so the reviewer confirms delivery through message trace. The trace also shows whether the recipient received the original content, a modified version or a replacement warning.

The reviewer documents the release decision immediately, including the quarantine reason, indicators reviewed, business justification, approver, recipient, timestamp, message ID and delivery status. If a trusted sender's attachment triggered a false positive, the record captures that context without broadly changing the detection policy. A narrow exception preserves protection for other users while the decision stays reproducible, reviewable and reversible.

3. Investigate One Message Without Contaminating Evidence

Individual message analysis follows a repeatable evidence sequence. The analyst preserves the quarantine record and headers, captures URL and attachment metadata and calculates file hashes, then compares those indicators with internal mail activity and approved business relationships. A hash lets analysts compare the file with other detections without repeatedly downloading or executing it.

Downloading the message is appropriate only when analysis requires the original file. If the portal provides a password-protected .eml download, the analyst transfers it through an approved process to a restricted evidence location and records the download time and operator. The supplied password travels through a separate approved channel, and no one opens an attachment from the downloaded file on a normal user device.

The original .eml file stays unchanged, while a working copy supports parsing, detonation or extraction. Calculating a hash for both files and documenting any submission to an internal sandbox or approved external analysis service, including destination, submission time, case number and findings, preserves chain of custody from quarantine through analysis.

Submission for deeper analysis makes sense when indicators are unclear, the campaign appears active or the decision could affect multiple users. The submission should include complete headers, message ID, URLs, attachment hashes, sender and recipient context and the reason for escalation. Forwarding a suspicious message as an ordinary email is unsafe because forwarding can alter headers, trigger tracking or expose sensitive content.

According to APWG's Phishing Activity Trends Report, 1st Quarter 2026, spam campaigns reported to the group fell to 35,583 in Q1 2026, down from 45,355 in Q4 2025 and 81,710 in Q3 2025, because email systems block users from forwarding phishing lures they perceive as harmful. Evidence handling that depends on forwarding therefore fails twice, losing header fidelity and often never reaching its destination.

4. Preserve Audit Records and Assign the Right Permissions

Quarantine management requires separation of duties. A help desk or security-awareness operator may need permission to view quarantine and submit messages for analysis, while a mail administrator handles release and deletion. Incident responders need message trace, advanced hunting and remediation access, and compliance, legal or forensic teams may require read-only access to audit records and preserved evidence.

The narrowest role that supports each task is the safest default. Release and bulk-delete permissions belong with a limited group, and approval authority should sit apart from routine message review whenever a request involves financial instructions, executive impersonation, regulated data or an active incident. Privileged access needs periodic review, and emergency access should end when the case closes.

Audit logs should capture the full set of quarantine activity:

• Searches, previews, downloads and submissions,
• Approvals, denials, releases and deletions,
• Bulk actions, permission changes and policy edits.

Microsoft records many administrator and user actions on quarantined messages in the audit log, so analysts can export relevant records into the incident case with timestamps in a consistent time zone. Linking every action to the message ID or investigation number lets another analyst reconstruct the decision without relying on personal notes.

The case closes only after the team confirms the final disposition, affected recipients, remediation result and evidence location. The record states whether the message was a false positive, spam, malicious or unresolved, which indicators supported that judgment, who approved the action and whether the quarantine policy requires tuning. Six months later, an auditor can open that case and see exactly why a flagged payroll message reached its recipient.

Manual release reviews measure analyst patience while cyberattackers measure how long a campaign stays live. Adaptive Security triages reported and quarantined messages together, then removes matching cyber threats automatically.

Take a self-guided tour

How Do Email Advanced Threat Protection Quarantine Policies Govern Notifications, Retention and Access?

Email advanced threat protection quarantine policies control when users receive quarantine notices, how long messages remain available and which actions recipients can take. In Microsoft 365, notification timing, quarantine access and release permissions depend on the detection type and assigned policy, and a missing notification does not show whether a message was delivered or deleted. These settings also shape cybersecurity awareness training, because employees learn to trust legitimate notices only when those notices look consistent.

According to the UK Department for Science, Innovation and Technology's Cyber Security Breaches Survey 2025/2026, the share of businesses with a breach or cyberattack that experienced phishing only, with no other type, rose from 45% in the previous year's survey to 51%. For many organizations, the quarantine notification is therefore one of the most frequent security messages employees read.

How Should Administrators Configure Quarantine Notifications?

Administrators can set quarantine notifications to arrive within 4 hours, daily or weekly. They can also configure the sender address, display name, subject, company logo, disclaimer and supported languages. The default sender is quarantine@messaging.microsoft.com, but an internal address can make legitimate notices easier for employees to recognize.

Custom disclaimers are limited to 200 characters, and notification text is localized according to the recipient's cloud mailbox language. Microsoft 365 supports custom sender names, subjects and disclaimers for up to three languages, and administrators should select each language before entering its text because changing the language can clear unsaved values. American and British English are configured separately, with the British setting covering other English clients such as Canada and Australia, while on-premises mailboxes receive no localized notifications.

Employees should verify the sender address, branding and destination before selecting Review message, Release or Request release. Security teams can direct users to open the Microsoft Defender quarantine portal from a known bookmark instead of following an unexpected email link. A legitimate notification never requests a password, multifactor authentication (MFA) code or payment, and employees should contact the help desk through a known channel when a notice looks unusual.

How Long Do Quarantined Messages Remain Available?

Retention depends on the detection that placed the message in quarantine:

• Anti-spam verdicts, including spam, high-confidence spam, phishing, high-confidence phishing and bulk, remain for 15 days by default in the default policy and in new custom policies (configurable from 1 to 30 days) and for 30 days under the Standard and Strict presets;
• Anti-phishing verdicts, including spoof intelligence, impersonation and mailbox intelligence detections, follow the retention value of the first matching anti-spam policy;
• Malware, Safe Attachments and mail flow rule detections, including password-protected attachments that cannot be scanned, remain for 30 days, a value administrators cannot change.

Expired messages are permanently deleted and cannot be recovered. When a user cannot find an older message, administrators should check the quarantine reason, retention setting and message trace before assuming the notification failed. Security teams should also set review targets well inside these windows so high-risk campaigns are examined while the evidence still exists.

How Do Shared Mailboxes and Outbound Quarantine Behave?

Shared-mailbox notifications go only to users with FullAccess permission, assigned directly or through a cloud-only security group. Distribution groups can send notifications to all members, while Microsoft 365 Group notifications depend on whether group conversations and events are sent to members. On-premises synchronized groups do not support shared-mailbox quarantine management.

Outbound quarantine requires separate administrative review because the sender, rather than the recipient, may be the affected account. Users should treat an outbound quarantine notification as a reason to contact security, since the notice does not approve any action by itself. Administrators should confirm the detection, inspect message headers and verify the business purpose through an independent channel before approving delivery.

A consistent reporting process limits accidental releases and gives security teams better behavioral signals. When a finance clerk reports an unusual outbound notice instead of acting on it, analysts can trace whether the account itself was compromised.

How Do Safe Attachments Policies Quarantine Malicious or Unscannable Files Under Email Advanced Threat Protection Quarantine Policies?

Safe Attachments extends email advanced threat protection quarantine policies by inspecting files in an isolated analysis environment before recipients can open them. The Block action holds the message during scanning, and Dynamic Delivery sends the message body first while replacing the file with a temporary placeholder. Block provides stronger containment but can delay legitimate business files, whereas Dynamic Delivery preserves message access with client-specific limitations covered below.

According to APWG's Phishing Activity Trends Report, 1st Quarter 2026, observed phishing cyberattacks rose 13.8% from 853,244 in the last quarter of 2025 to 971,181 in Q1 2026. Rising volume puts more attachment verdicts in front of Safe Attachments, which makes carefully ordered recipient conditions, narrow exceptions and representative test messages essential.

What Happens When Safe Attachments Scans a File?

Safe Attachments detonates supported files in an isolated environment and evaluates their behavior for malware, ransomware activity, exploit techniques and other malicious signals, as described in Microsoft's Safe Attachments documentation. A clean verdict allows delivery according to the selected policy action. A malicious verdict triggers the configured response, which places the message in quarantine for administrator review.

Unscannable files carry unresolved risk. Password-protected archives, encrypted attachments, unsupported formats, damaged files and S/MIME-protected messages can prevent full inspection, so they belong in a separate risk category rather than a standing exception. Security teams should review unscannable activity, confirm the sender relationship and use a controlled file-transfer process when content cannot be inspected.

Policy scope determines which recipients receive each result. Recipient conditions can target specific users, groups, domains or organizational segments, and exceptions can exclude approved automated mailboxes, although a broad exemption creates a direct path around Safe Attachments. When multiple policies match a message, the highest-priority applicable policy determines the action, as outlined in Microsoft's Safe Attachments policy configuration guidance.

How Do Block and Dynamic Delivery Compare?

Block is the containment-first option. Safe Attachments holds the message while analysis runs and releases the content only when the policy permits delivery. This approach creates a clear security boundary, but a slow scan can delay invoices, contracts and hiring documents and generate support requests from employees who do not understand why a legitimate message has not arrived.

Dynamic Delivery separates message access from attachment access. The recipient receives the message body and sees a placeholder while Safe Attachments scans the file, which preserves conversation flow without exposing the original attachment. After a clean verdict the attachment becomes available, while a malware verdict keeps it unavailable and triggers the configured remediation path.

Dynamic Delivery behaves differently for public-folder messages, S/MIME-protected messages, mobile devices, messages sent to on-premises recipients and messages moved between folders or mailboxes. A user on a mobile device can encounter the placeholder without immediate access to the file, and an on-premises recipient might not receive the same dynamic experience. Validating the workflow on every supported client should precede any decision to make Dynamic Delivery the default.

How Should Encrypted and Password-Protected Attachments Be Handled?

Encrypted and password-protected attachments require an explicit operating rule because Safe Attachments cannot inspect content it cannot open. Administrators can release these messages without a password, which makes administrator verification of the sender especially important.

Organizations should prohibit emailing passwords alongside files and avoid blanket exceptions for encrypted archives. Approved secure file sharing, sender verification or manual security review offers a safer path than asking employees to decide whether an encrypted file is trustworthy.

Advanced hunting helps security teams find messages containing password-protected or otherwise unscannable attachments, correlate them with sender and recipient activity and identify repeated campaigns. Analysts can use those results to tune recipient conditions, investigate unusual senders and confirm whether the attachment was later released or accessed. Pairing Microsoft 365 telemetry with a phishing response and triage workflow gives analysts a controlled process for reviewing suspicious files without placing the final risk decision on employees.

How Can Teams Verify a Safe Attachments Quarantine Policy?

Verification begins with a pilot group that represents finance, executives, remote users, mobile users, shared mailboxes and any on-premises recipients. The pilot should exercise the attachment types most likely to break the workflow:

• Clean files and inert malicious-test files,
• Password-protected, encrypted and S/MIME-protected files,
• Oversized and unsupported file types.

For each file, the team confirms the message location, user notification, attachment visibility, administrator alert, quarantine action and audit record. Policy priority needs a fresh review after every change, because a broader higher-priority rule that delivers unscannable content overrides the intended protection. Every exception needs a documented owner and a removal date, so a vendor workaround created for one quarter stops bypassing attachment scanning once the contract ends.

Malicious attachments that reach several recipients need removal from every inbox at once. Adaptive Security scans attachments for malware, removes confirmed cyber threats and coaches each targeted employee.

Explore the platform

How Do Administrators Configure Email Advanced Threat Protection Quarantine Policies in Exchange Online PowerShell?

Exchange Online PowerShell gives administrators a scriptable way to manage email advanced threat protection quarantine policies across discovery, permission design, policy assignment and operational review. A controlled workflow connects with least privilege, inspects existing policies, creates custom access profiles with validated permission values and assigns them only to detection policies that send messages to quarantine. Every change should pass the same review as any configuration deployment, because permissive release settings can open an unintended delivery path out of quarantine.

1. Discover the Tenant and Validate Permissions

A secure session starts with modern authentication and a named administrative account rather than shared credentials:

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

Get-ConnectionInformation

A role that permits quarantine administration without defaulting to Global Administrator limits exposure if the session is compromised. After confirming the tenant context, the administrator exports the current state for review:

Get-QuarantinePolicy | Format-Table Name,QuarantinePolicyType

Get-QuarantinePolicy -QuarantinePolicyType GlobalQuarantinePolicy

Get-HostedContentFilterPolicy | Format-List Name,*QuarantineTag

Get-AntiPhishPolicy | Format-List Name,*QuarantineTag

Get-MalwareFilterPolicy | Format-List Name,QuarantineTag

Get-SafeAttachmentPolicy | Format-List Name,Enable,Action,QuarantineTag

Microsoft defines end-user permission values as bit flags in its New-QuarantinePolicy documentation. From highest to lowest, the values are:

• PermissionToViewHeader (128), which stays available whenever the message is visible,
• PermissionToDownload (64), which Microsoft no longer uses,
• PermissionToAllowSender (32),
• PermissionToBlockSender (16),
• PermissionToRequestRelease (8),
• PermissionToRelease (4),
• PermissionToPreview (2),
• PermissionToDelete (1).

Administrator permissions and recipient permissions are separate. Running Get-QuarantinePolicy shows what recipients can do under the assigned policy, which the administrator view cannot reveal on its own.

2. Automate Policy Creation and Assignment

The permission value should come from an approved access design before New-QuarantinePolicy runs; Limited access combines request release, preview, delete and allow sender for a decimal value of 43 and No access is 0. Full access is a permission group that includes Release, Delete, Preview message, View message headers and Allow sender. Request release and release are mutually exclusive, so a validation step should reject any value that enables both:

$PolicyName = "ATP-LimitedAccess"

$PermissionValue = 43

if ($PermissionValue -lt 0 -or $PermissionValue -gt 255) {

throw "EndUserQuarantinePermissionsValue is outside the valid 8-bit range."

}

if (($PermissionValue -band 8) -and ($PermissionValue -band 4)) {

throw "Request release and release cannot be enabled together."

}

New-QuarantinePolicy `

-Name $PolicyName `

-EndUserQuarantinePermissionsValue $PermissionValue `

-ESNEnabled $true

Assignment applies only where the detection action is quarantine. An anti-spam policy, for example, can use the custom policy for spam and phishing verdicts:

Set-HostedContentFilterPolicy `

-Identity "Inbound Protection" `

-SpamAction Quarantine `

-SpamQuarantineTag $PolicyName `

-PhishSpamAction Quarantine `

-PhishQuarantineTag $PolicyName

Separate policies for ordinary spam, impersonation detections and malware keep permissions aligned with risk. For malware and high-confidence phishing, Microsoft converts any release permission into a release request that requires administrator review.

Global notification language, sender name, subject, disclaimer, sender address, branding and frequency are set through the global quarantine policy. Administrators should keep the disclaimer concise, test each language against the recipient mailbox locale and align the entries across all multivalued parameters:

Get-QuarantinePolicy -QuarantinePolicyType GlobalQuarantinePolicy |

Set-QuarantinePolicy `

-MultiLanguageSetting ('Default','Spanish') `

-MultiLanguageCustomDisclaimer ('Verify unexpected requests with the Security team.','Verifique las solicitudes inesperadas con el equipo de Seguridad.') `

-ESNCustomSubject ('Quarantined email requires review','Revise el correo en cuarentena') `

-MultiLanguageSenderName ('Contoso Security','Seguridad de Contoso') `

-EndUserSpamNotificationCustomFromAddress security@contoso.com `

-OrganizationBrandingEnabled $true `

-EndUserSpamNotificationFrequency 1.00:00:00

3. Verify, Audit and Roll Back Changes

Verification must confirm both the policy object and every detection policy that references it. A before-and-after export allows the administrator to compare assigned quarantine tags and permission values:

Get-QuarantinePolicy -Identity $PolicyName |

Format-List Name,EndUserQuarantinePermissionsValue,ESNEnabled

Get-HostedContentFilterPolicy | Format-List Name,*QuarantineTag

Get-AntiPhishPolicy | Format-List Name,*QuarantineTag

A controlled test message then confirms that the recipient sees only the intended actions. Release requests go through the quarantine administration workflow, with approval only after header and context review and a retained decision record. Relevant quarantine and release audit records should also flow to the organization's central logging process.

Before removing or changing a policy, the administrator confirms that no anti-spam, anti-phishing, anti-malware or Safe Attachments policy still references it. Rollback restores the exported permission value and original quarantine tag, followed by the same verification commands. A reviewer comparing the two exports can see exactly which tag changed, when it changed and under whose account.

How Should Organizations Design Email Advanced Threat Protection Quarantine Policies for Different Mailbox Risk Profiles?

Email advanced threat protection quarantine policies should weigh mailbox risk, business urgency and the consequences of releasing a suspicious message. High-risk roles need administrator-controlled review, while lower-risk recipients can use controlled self-release with safeguards. The right design is a documented matrix that limits exceptions, records decisions and preserves legitimate communication without treating every mailbox the same.

According to the UK Department for Science, Innovation and Technology's Cyber Security Breaches Survey 2025/2026, phishing remained the most prevalent type of breach or cyberattack, experienced by 38% of businesses. Because phishing reaches nearly every mailbox type, the meaningful difference between mailboxes lies in what each one can authorize.

Executives, finance teams, payroll, procurement, legal staff and administrators require stricter controls because a convincing business email compromise or spear phishing message can authorize payments, expose sensitive data or redirect an entire team. Shared mailboxes, service accounts and automated applications require process-based controls because no individual user can reliably judge every message in context. Urgency can inform a review, yet it should never override one.

How Should Email Advanced Threat Protection Quarantine Policies Treat Human Risk Profiles?

Human risk profiles should determine who can release quarantined messages and how much verification each release requires. High-risk roles generally warrant administrator-controlled access, where a security or messaging analyst reviews sender identity, authentication results, attachment behavior, links, reply-chain history and business context before release.

According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, internet crime drove $20.877 billion in reported losses, a 26% jump over the prior year ($16.6 billion in 2024). BEC alone accounted for $3.05 billion of those losses across 24,768 complaints, which is why finance and executive mailboxes deserve the tightest release controls.

Contractors and external collaborators need a separate policy with no automatic trust. Controlled user release suits them only when the message is low risk, the sender has an established relationship and no high-confidence malware, impersonation or credential-theft signal exists. Higher-risk messages should go to an internal sponsor or the security team, which prevents external mailbox access from becoming an indirect path into sensitive workflows.

The following matrix maps common mailbox types to default quarantine actions and release authority.

Release decisions, user reports and remediation actions should stay visible to the security team through one reporting and triage record. A quarantine policy that blocks messages without recording why others were released leaves no defensible risk history when an auditor asks.

How Should Email Advanced Threat Protection Quarantine Policies Treat Non-Human Mailboxes and Senders?

Non-human mailboxes require identity and process validation rather than user discretion. Service accounts, automated applications, ticketing systems and marketing platforms often generate legitimate high-volume traffic, and their predictable behavior makes deviations easier to detect. Before creating an exception, administrators should document the approved sending domain, authentication requirements, expected recipients, message types, sending frequency and responsible owner.

A ticketing system should receive permission only for the verified sender, authenticated domain and required header pattern, with monitoring for changes, instead of a blanket allow entry for an entire vendor domain. Marketing platforms should use dedicated sending domains and narrowly scoped policies, especially when campaigns include links, attachments or external landing pages. Legitimate bulk senders should pass authentication and reputation checks without bypassing malware, impersonation or data-loss controls.

Service accounts should hold no interactive release privileges. When an automated message is quarantined, the application owner and security team review it and correct the sending configuration rather than releasing individual messages indefinitely. Shared mailboxes need at least two accountable owners, and a named owner should approve any release tied to payments, credentials, employee records or customer data.

How Should Organizations Govern Exceptions and Privacy in Email Advanced Threat Protection Quarantine Policies?

Exception governance determines whether quarantine policies reduce risk or quietly create bypasses. Organizations should never allow an entire free-mail domain, broad display-name pattern, newly registered domain or unverified vendor domain merely because messages are operationally important. The narrowest possible condition, an expiration date, a documented business owner and a scheduled review keep each exception accountable. Every exception record should answer four questions:

• What the exception allows,
• Why the business needs it,
• Who approved it,
• When it will be removed.

Administrators also need privacy controls because quarantined messages can contain employee correspondence, customer information, health details, financial records or legal communications. Reviewers should preview only the content necessary for a release decision, while role-based permissions restrict access and logs capture every preview, download, share and release. Suspicious content should never travel to personal accounts or unapproved analysis tools.

Reviewer access and retention for quarantined mail should map to the privacy laws that apply to the organization, such as state privacy laws and HIPAA for health information. Organizations should define retention periods for quarantined content and security logs, encrypt exports and establish a documented process for data-subject requests and legal holds. Any malware-analysis service that receives a submitted message must be approved for the data classification involved.

Well-governed email advanced threat protection quarantine policies protect both the inbox and the people whose information passes through it. In practice, an expired vendor allowance disappears on its review date and an analyst's preview of a payroll message appears in the audit log.

A standing exception for one vendor domain can outlive the business relationship and quietly bypass protection. Adaptive Security ties every detection to employee risk scores that expose those gaps.

Book a demo

How Should Security Teams Test and Roll Out Email Advanced Threat Protection Quarantine Policies?

Testing and staged rollout protect production mail while email advanced threat protection quarantine policies change. Benign test messages, representative pilot groups, peer review and documented rollback triggers let teams observe real behavior before every mailbox depends on it. The approach also gives security leaders an auditable record that links each change to its measured outcome.

1. Test Policies Before Production Assignment

Preproduction testing should use benign messages that reproduce the structure of real cyber threats without containing malicious payloads. Controlled samples should cover spam, phishing, malware, spoofing, impersonation, Safe Attachments verdicts, notification workflows, release requests, shared mailboxes and likely false positives. Known verdict scenarios, approved test domains, inert attachment files and internal sender identities let analysts validate behavior without weakening live protection.

The test matrix below pairs each scenario with what to validate and the condition for passing.

Recording the expected result beside the observed result makes failures visible. A failed test should block promotion instead of triggering an immediate production exception.

2. Roll Out Changes in Stages

Staged rollout limits the impact when a rule behaves differently in production. A representative pilot includes security administrators, finance staff, executive support, customer-facing employees and shared-mailbox owners, since technically sophisticated employees rarely represent the organization's wider exposure.

Before assignment, a peer reviewer compares the proposed rule with the current baseline, confirms its scope and checks exclusions for approved senders and business workflows. An authorized owner approves the change after review, and the record captures the policy name, purpose, affected tenant or group, author, reviewer, approval time, version number, expected outcome and rollback instruction.

Pilot results should be measured over a defined observation window. The team tracks quarantine volume, false-positive reports, release requests, delivery delays, user complaints, notification failures and analyst workload, then expands only when results remain within predetermined thresholds.

Rollback becomes necessary under specific conditions:

• A rule blocks critical business communication,
• Release requests rise sharply without explanation,
• Shared-mailbox workflows break,
• Equivalent test messages produce inconsistent verdicts.

Emergency changes should stay narrow and time-limited. The record documents the triggering incident, affected scope, approver, expiration time and follow-up test plan. After the incident, the team compares the emergency rule with the approved baseline and completes peer review before making it permanent.

3. Govern Multi-Tenant Configuration Consistently

Multi-tenant environments require one canonical policy standard that every tenant inherits. A version-controlled baseline covers detection logic, quarantine actions, notification language, release permissions, exclusions and retention settings. Each tenant needs an owner, and configuration drift is reviewed on a fixed schedule.

The same test matrix applies across regional tenants, subsidiaries and acquired Microsoft 365 environments, with platform-specific differences documented. A policy counts as deployed only when its version, assignment scope, exceptions and observed verdicts match the approved record. When a tenant requires a deviation, the record captures the business reason, risk owner, expiration date and compensating control.

According to the World Economic Forum's 2026 Global Cybersecurity Outlook, 52% of highly resilient organizations indicate that board members receive regular cybersecurity updates, and 48% report that board members are actively engaged with cybersecurity issues. Drift reports and exception registers from each tenant give security leaders concrete material for those board updates.

How Should Security Teams Respond When Email Advanced Threat Protection Quarantine Policies Reveal a Phishing Campaign?

When email advanced threat protection quarantine policies isolate one phishing message, security teams should treat it as evidence of a campaign until investigation proves otherwise. The response identifies every recipient, searches message IDs and URLs, compares attachment hashes, reviews authentication and header signals, traces delivery and removes related messages. Anyone who interacted with a fake quarantine notification requires immediate account and endpoint containment, with clear communication that lets employees report exposure without fear of blame.

According to the CrowdStrike 2026 Global Threat Report, the average adversary breakout time, the window between initial access and lateral movement, dropped to 29 minutes, with the fastest measured at just 27 seconds. Campaign scoping therefore has to begin within minutes of the first quarantine alert.

1. Scope the Campaign Before Deleting Evidence

The quarantined message stays preserved in its original form, including full headers, message ID, sender details, URLs, attachments and timestamps. Analysts then search the mail environment and advanced hunting data for the same message ID, sender infrastructure, Reply-To address, subject pattern, URL, attachment name and attachment hash. Message IDs can change across forwarded or rewritten mail, so multiple indicators produce a more complete result than one exact match.

Exact matches and related indicators carry different weights. An identical message ID indicates the same message instance, while a shared URL, attachment hash, sending infrastructure or subject pattern can reveal variants, so analysts record each indicator and its confidence instead of treating every message from the same domain as malicious. A broad search based only on a common sender domain can remove legitimate correspondence, while a narrow search based only on the original subject can miss customized spear phishing.

Every recipient and delivery state needs mapping, including aliases, shared mailboxes, executive accounts, mobile users and messages delivered before detection becomes active. Analysts separate quarantined messages from those delivered to inboxes, spam folders, mobile mail clients or delegated accounts. Email authentication results (SPF, DKIM and DMARC), compared with the return path, reply-to address, originating IP and relay information, show whether the campaign used spoofing, a compromised account, a lookalike domain or an abused legitimate service.

Post-delivery activity completes the picture. Analysts check URL click telemetry, proxy and DNS records, identity provider logs, browser activity, endpoint alerts and authentication events. The resulting exposure list records who opened the message, clicked a link, downloaded an attachment, submitted credentials, approved a multifactor authentication prompt or replied, which directs containment without forcing blanket account resets.

2. Contain Exposure and Begin Recovery

Containment removes every related message from user mailboxes, including copies delivered before the quarantine policy triggered. Analysts block confirmed malicious URLs, domains, sender addresses and attachment hashes through approved controls while retaining the original artifacts and detection logic. If a compromised legitimate account delivered the message, blocking one sender address leaves the campaign running, so the team revokes active sessions and investigates the account's sending history.

A user who interacts with a fake quarantine notification should be treated as having compromised credentials. The team resets the password, revokes refresh tokens and active sessions, invalidates remembered devices where appropriate and reviews recent sign-ins for unfamiliar locations, applications, forwarding rules, mailbox permissions and newly registered authentication methods. The endpoint also needs inspection for downloaded payloads, malicious browser extensions, altered proxy settings and suspicious processes, with isolation when telemetry shows execution or persistence.

Targeted communication works better than a broad warning that hands cyberattackers useful details. Affected users learn what action occurred, what information security needs and how to verify future quarantine notices through the approved mail interface, and questions about opened messages, clicks, submitted credentials or completed transactions should carry no blame. CISA's phishing guidance recommends reporting suspicious messages and avoiding untrusted content, which makes prompt employee reporting a critical containment signal.

Evidence preservation runs alongside containment. Message files, headers, URLs, hashes, authentication logs, identity events, endpoint evidence and analyst decisions should be captured before systems rotate or purge them. A Phish Triage workflow can centralize reported messages, classification signals and mailbox remediation while analysts investigate the wider campaign.

3. Document Lessons and Strengthen Response

The incident closes with a precise scope statement covering initial detection, recipient count, delivery paths, confirmed interactions, credential submissions, affected accounts, endpoint findings, removed messages, revoked sessions and unresolved questions. The record also names the quarantine policy that detected the message and the signals it missed. This evidence supports legal, regulatory, insurance and executive decisions without overstating what the investigation established.

Findings should become control changes and practice. Teams tune quarantine policies around the campaign's actual indicators, strengthen external-sender labeling, require independent verification for sensitive requests and test whether users can distinguish a genuine quarantine notice from a spoofed one. Recurring user confusion feeds targeted cybersecurity awareness training, follow-up phishing simulations measure reporting speed and the employee who clicked becomes a source of timeline data for a clearer next warning.

Searching inboxes one by one leaves a phishing campaign active while analysts work. Adaptive Security removes similar cyberattacks from every affected mailbox, with reversible actions and configurable review thresholds.

Book a demo

Which Metrics Show Whether Email Advanced Threat Protection Quarantine Policies Are Working?

Email advanced threat protection quarantine policies work when they capture malicious messages without creating unacceptable delays for legitimate business. The NIST Cybersecurity Framework 2.0, published in 2024, treats measurement and continuous improvement as core cybersecurity practices. A useful dashboard separates operational activity, service quality and risk reduction, because quarantine volume alone does not measure success.

According to the UK Department for Science, Innovation and Technology's Cyber Security Breaches Survey 2025/2026, phishing was most commonly identified as the most disruptive incident, cited by 69% of affected businesses and charities. Metrics that count only blocked volume miss that disruption, which surfaces in delays, release failures and analyst workload.

Which Effectiveness Metrics Should Security Teams Track?

Effectiveness metrics show whether the control identifies the right messages and improves decisions over time. Teams should establish a documented baseline for at least 30 days before changing thresholds, then review results weekly during rollout and monthly after behavior stabilizes.

Malicious-message capture should be tracked by verdict and cyberattack type, including credential phishing, malware, business email compromise, malicious attachments and dangerous links. Pairing that number with confirmed misses from user reports, investigations or post-delivery remediation gives it meaning. A rising quarantine count can indicate a campaign surge, an overly broad policy or a rule duplicating another control, so it requires interpretation before celebration.

Precision metrics complete the picture:

• False-positive rate: This metric divides legitimate messages incorrectly quarantined by all legitimate messages processed, while dividing by all reviewed quarantined messages gives the false discovery rate;
• Release rate: A high share of released messages can signal poor detection precision, confusing policy design or users requesting messages without understanding the risk;
• Release-request approval rate: Many requests with few approvals point to notification language and request context that need improvement before any threshold change.

Campaign recurrence connects individual events to broader risk. Grouping quarantined messages by sender infrastructure, subject pattern, impersonated executive, domain and cyberattack technique shows whether campaigns persist after a policy change, which signals a need for a narrower rule, a new detection signal or coordinated user reporting. Comparing reported messages with quarantine verdicts also exposes gaps between automated detection and employee judgment.

Which Service-Quality Metrics Protect Business Operations?

Service-quality metrics show whether quarantine is usable enough for employees and analysts to act quickly. Teams should measure median and 95th-percentile review time, time from release approval to delivery, legitimate business-email delay, notification delivery rate and notification action rate. A policy that catches cyber threats but delays invoices, contracts or customer requests creates operational risk that security leaders must document and address.

Release failures should be tracked by reason, including expired items, authorization errors, transport failures and messages no longer available. Incomplete bulk actions should appear as their own category, so a bulk release that processes 980 of 1,000 messages produces a visible exception queue and reconciliation step.

User reporting is another service signal. Teams record reports per 1,000 active mailboxes, duplicate reports, analyst-confirmed malicious reports and reports of messages already in quarantine. Low reporting can mean employees see fewer cyber threats, but it can also mean notifications are missing, the reporting workflow is difficult or users distrust the process, so the metric needs reading alongside capture and notification data.

Review thresholds should be documented before production changes. Escalation applies when false positives exceed the approved business baseline, legitimate-message delay breaches the service objective, notification delivery falls below target or analyst review time exceeds available capacity. These conditions trigger an investigation, and any move to weaken quarantine still requires a separate approved change.

What Should a Quarantine Troubleshooting Runbook Include?

A runbook should begin with message trace data, policy evaluation order, recipient type, quarantine status, timestamps and the exact action attempted. The analyst records the case ID and preserves the original message metadata so the behavior can be reproduced without relying on a user's forwarded copy.

Common failure types each have a defined check:

• Missing notifications: Analysts verify the recipient address, notification schedule, mail-flow delivery, spam placement, suppression settings and template status;
• Failed releases: Analysts confirm that the item has not expired, the requester has permission, the message still exists and the release destination matches the original recipient, recording expired items as availability failures;
• Incomplete bulk actions: Analysts compare requested, attempted, successful and failed counts, then retry only the failed subset after identifying the error class;
• Shared-mailbox messages: Analysts confirm that the mailbox is in policy scope, delegates receive the correct notification and release permissions apply to the shared address.

Inconsistent behavior across policies usually points to scope overlap, rule precedence, conflicting exceptions, recipient segmentation or different action thresholds. Analysts compare policies side by side, test one controlled message against each scope and document every control change with its reason, owner, expected effect and review date. Over several quarters, that change log shows whether falling quarantine volume reflects safer employee behavior or simply a quieter phishing season.

Scattered quarantine volume, release requests and reporting speed hide which employees carry the most risk. Adaptive Security's reporting combines them into one view of the most-targeted employees in every department.

Take a self-guided tour

Where Email Advanced Threat Protection Quarantine Policies Meet Cybersecurity Awareness Training

When email advanced threat protection quarantine policies stop a suspicious message before delivery, they reduce immediate exposure while the human decision that follows remains open. Quarantine creates a control boundary, and cybersecurity awareness training determines whether employees recognize suspicious notifications, report them and resist unsafe release or credential requests. The two work as one defense only when training content reflects how the organization's quarantine workflow actually looks.

According to Öner, Çetin and Savaş in Human Factors in Phishing: Understanding Susceptibility and Resilience (2025), a two-year study of 8,102 employees at a large European financial organization found that gender, age and department type influenced phishing susceptibility and that higher-level employees often underreported phishing emails. Those differences support training that follows role and exposure rather than organization-wide averages.

Where Is the Control Boundary Between Email Advanced Threat Protection Quarantine Policies and Employee Action?

Quarantine controls a message before it reaches the inbox, yet many actions around that message remain in employee hands. Employees still receive quarantine notices, approve release requests, review sender details and respond to follow-up messages claiming the original email was blocked by mistake. Cyberattackers can therefore shift the cyberattack from the email itself to the notification workflow.

Effective policy design makes the safe action obvious. Release requests should require a clear business reason, identity verification and a defined escalation path for unusual messages, and security teams should explain in plain language why a message was held. Clear explanations reduce repeated support requests, discourage unsafe workarounds and give employees a practical signal they can apply to similar requests.

Security leaders can reinforce that boundary through security awareness training focused on phishing and social engineering, using short scenarios that contrast a legitimate release workflow with an impersonation attempt. Employees need a repeatable response that does not depend on technical analysis: pause, verify through a trusted channel and report the request when the context does not fit.

How Does Employee Reporting Behavior Improve Email Advanced Threat Protection Quarantine Policies?

Employee reporting converts quarantine from a one-way filter into a feedback signal. A report identifying a suspicious quarantine notification, a false positive or a message that bypassed policy shows the security team where the control works and where employees need clearer guidance.

Reporting quality matters more than raw volume. A useful report preserves the original message, identifies the requested action and explains why the message appears suspicious. A vague alert still deserves recognition, but analysts gain more from a description of an unexpected payment request, a credential prompt, a mismatched sender domain or pressure to release a quarantined item.

False-positive patterns deserve equal attention. If a finance team repeatedly requests release of legitimate invoices, the cause could be policy precision, unclear vendor workflows or a gap in document-verification skills. If one role repeatedly interacts with messages carrying phishing signals, targeted coaching should address that role's actual workflow and build skill rather than punishing employees for asking for help.

How Can Quarantine Data Feed a Cybersecurity Awareness Training Program?

Quarantine events become useful human-risk signals when security teams connect them to behavior over time. Useful measures include release requests, reported messages, repeated exposure to similar lures, time to report, false-positive rates and credential submissions after suspicious prompts. Reviewing those measures by role, department, location and privilege level lets a cybersecurity awareness training program follow exposure rather than organizational convenience.

Each role's pattern should produce a specific intervention:

• A finance employee who frequently receives vendor-payment requests needs practice verifying account changes and payment instructions;
• An executive assistant who manages calendars and travel needs scenarios involving urgent document sharing or impersonated leadership;
• An IT administrator needs drills that distinguish legitimate account recovery from a fraudulent credential reset.

After training, teams should measure whether reporting becomes faster and more accurate, unsafe release requests decline and employees verify unusual instructions through an independent channel. The loop holds when detection policies reflect the organization's highest-risk cyberattack patterns and training rehearses the exact notices employees see.

If employees cannot distinguish a genuine quarantine notice from a spoofed one, every release workflow becomes an attack surface. Adaptive Security builds that judgment through realistic phishing simulations.

Take a self-guided tour

How Adaptive Security Strengthens Email Advanced Threat Protection Quarantine Policies

Security teams that run email advanced threat protection quarantine policies well can show three outcomes: fewer dangerous messages reach employees, fewer unsafe releases occur and every quarantined cyber threat becomes a coaching opportunity. Adaptive Security's Cloud Email Security layers AI-native detection onto Microsoft 365 and Google Workspace through an API, with no MX record or mail-flow changes. It combines behavioral signals, intent analysis and large language model reasoning, quarantines suspicious email until an administrator reviews, restores or deletes it and attaches a confidence score and explanation to every verdict.

Confirmed cyber threats are removed automatically from every inbox they reach, similar messages are taken down at the same time and every remediation action remains reversible. Employee reports flow into Phish Triage, and reported phishing feeds back into detection to improve accuracy. Analysts work from one record that connects what the filter caught with what employees noticed.

Every detection also connects to the employee it targeted, updating that person's risk score and assigning relevant security awareness training automatically. Security leaders see cyberattack volume, cyber threat breakdowns and the most-targeted employees in one view, so the cybersecurity awareness training platform can rehearse the exact lures each team receives.

Standalone quarantine consoles report what they blocked, while security leaders need to know which employees remain exposed. Adaptive Security connects detection, triage and cybersecurity awareness training on one platform.

Book a demo

Frequently Asked Questions About Email Advanced Threat Protection Quarantine Policies

What Are Email Advanced Threat Protection Quarantine Policies and How Do They Protect Users?

Email advanced threat protection quarantine policies are Microsoft 365 rules that control what recipients can do with quarantined messages, including viewing, releasing, deleting or requesting release. They protect users by keeping suspicious content out of inboxes while security teams keep review authority. Detection policies decide what gets quarantined, while quarantine policies decide access and notifications.

How Long Do Quarantined Emails Remain Available Before They Are Permanently Deleted?

Quarantined emails remain available for 15 to 30 days, depending on the verdict and policy. Anti-spam detections default to 15 days in default and custom policies and 30 days under the Standard and Strict presets, while anti-malware, Safe Attachments and mail flow rule detections stay for a fixed 30 days. Expired messages cannot be recovered.

Can Users Release a Quarantined Email That Contains Malware or a High-Confidence Phishing Verdict?

Users cannot directly release malware, Safe Attachments malware or phishing or high-confidence phishing detections. If the assigned quarantine policy grants release permission, Microsoft converts it into a release request that an authorized administrator must approve. Uncertain cases stay in quarantine until an analyst validates the sender, authentication results, links and attachments.

What Is the Difference Between No Access, Limited Access and Full Access Quarantine Permissions?

No access lets users view only message headers when notifications are enabled, while Limited access adds preview, deletion, Safe Senders changes and release requests. Full access is a permission group covering Release, Delete, Preview message, View message headers and Allow sender for eligible detections. No preset overrides verdict-specific restrictions on malware or high-confidence phishing.

How Should Organizations Test Email Advanced Threat Protection Quarantine Policies Without Weakening Production Protection?

Organizations should test email advanced threat protection quarantine policies with benign messages, controlled recipient groups, staged assignments and documented rollback criteria. Pilots should cover notifications, permissions, release requests, shared mailboxes and audit records. Teams then compare release rate, review time and business delay against baselines before expanding coverage beyond the pilot group.

Many quarantine decisions depend on whether employees report a suspicious message before cyberattackers repeat the campaign. Adaptive Security shortens that window with AI-native detection and automated remediation.

Book a demo