Email Quarantine User Guide

Take action on quarantined email

In the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Review > Quarantine > Email tab. Or, to go directly to the Email tab on the Quarantine page, use https://security.microsoft.com/quarantine?viewid=Email.

On the Email tab, select the quarantined email message by using either of the following methods:

Select the message from the list by selecting the check box next to the first column. The available actions are no longer grayed out.

Available actions after you select a quarantined message on the Email tab of the Quarantine page., Picture

Select the message from the list by clicking anywhere in the row other than the check box. The available actions are in the details flyout that opens.

The available actions in the details flyout of a quarantined message, Picture

Using either method to select the message, some actions are available under More or More options.

Preview email from quarantine

After you select the message, use either of the following methods to preview it:

On the Email tab: Select Preview message.
In the details flyout of the selected message: Select More options > Preview message.

In the flyout that opens, choose one of the following tabs:

Source: Shows the HTML version of the message body with all links disabled.
Plain text: Shows the message body in plain text.

Block email senders from quarantine

The Block sender action adds the message sender to the Blocked Senders list in your mailbox. For more information about blocking senders, see Block a mail sender.

After you select the message, use either of the following methods to add the message sender to the Blocked Senders list in your mailbox:

On the Email tab: Select More > Block sender.
In the details flyout of the selected message: Select More options > Block sender.

In the Block sender flyout that opens, review the information about the sender, and then select Block.