How to Check Quarantined Emails.

Q. I received an email with the subject "Microsoft 365 Security: You have messages in quarantine". What should I do?

A. Emails that are identified as potentially unsafe by the security features of THERS Mail (Exchange Online) are not delivered to your inbox. This process is called quarantine.
The email you received with the subject "Microsoft 365 Security: You have messages in quarantine" is a quarantine notification email informing you that some messages have been quarantined.
If you receive a quarantine notification email, please follow the steps below:

[Image Ⅰ]

The quarantine notification email is sent from the following address: quarantine@messaging.microsoft.com

The subject line of the quarantine notification email is: "Microsoft 365 Security: You have messages in quarantine"

◆Main Types of Quarantine Reasons ([Image Ⅰ].1)

◆Check the Email

Check whether the email was mistakenly marked as a threat (false positive).

【Check Point】

1.  Check the "Sender" and "Subject" of the email to determine whether it appears suspicious.
2.  Click "View Message" (see [Image Ⅰ].2) to review the content of the quarantined message.
3.  If the email seems legitimate, contact the sender directly to confirm whether they sent the message for a valid purpose.
4.  If the message is flagged as "Malware", do not release it under normal circumstances.
   Inform the sender that their email was detected as malware, and ask them to verify whether the attachment or content contains any issues.

〇 In Case of a False Positive

If the email is confirmed to be safe, click "Release" ([Image Ⅰ].3).
*Quarantined emails are messages that have been identified as potentially unsafe by the system.
Please carefully review the above checkpoints before releasing any quarantined email.
Exercise caution when deciding to release a message from quarantine.

After a short while, the released email will be delivered to your inbox.

〇 In Case of Spam

Click "Block" ([Image Ⅰ].4) to reject future emails from the sender.

◆Block Emails from the Sender

Click "Block" ([Image Ⅰ].4) to reject future emails from the sender.

◆Check Quarantined Emails from the Quarantine Page

1.  Access the Quarantine.(https://security.microsoft.com/quarantine)
   *You can also access the quarantine page from the "[Quarantine]" link in the quarantine notification email ([Image 1].6).
   [Image 2]

2.  Check whether the email is safe and was quarantined due to a false positive.

   【Check Point】

   1.  
      1. Check the "Sender" and "Subject" of the email to determine whether it is suspicious.
      2. Click the relevant message, then click "Preview message" to review its content ([Image 3].7).
         [Image 3]
         
      3.  If the email seems legitimate, contact the sender directly to confirm whether they sent the message for a valid purpose.
      4.  If the message is flagged as "Malware", do not release it under normal circumstances.
         Inform the sender that their email was detected as malware, and ask them to verify whether the attachment or content contains any issues.
          
3.  In Case of a False Positive
   1.  If the email is confirmed to be safe, click "Release" ([Image Ⅳ].9).
      *Quarantined emails are messages that have been identified as potentially unsafe by the system.
      Please carefully review the above checkpoints before releasing any quarantined email.
      Exercise caution when deciding to release a message from quarantine.
      [Image Ⅳ]
      
   2. Select "Report that this message does not contain a threat", then click "Release message" to deliver the email to the recipient’s inbox.
       
   3.  On the "Email has been released to the recipient’s inbox" screen, click the "Done".
       
4.  In Case of Spam
   1. Click "Delete from quarantine" ([Image 3].8) to delete the email.

◆Other Important Notes

• If you do not release or delete a quarantined email, it will be automatically deleted after the expiration date shown under "Expires".
• If the email remains listed on the quarantine page, a quarantine notification email will be sent. Please take appropriate action such as "Delete", "Release" or "Block".

• "High confidence phishing" emails are considered highly dangerous and therefore cannot be released manually by users.
  If the email was quarantined due to a false positive, please click "Request release" ([Image 1].5). An email will be sent to the administrator to request the release of the message.
  The email will be released only after the administrator has confirmed it is safe. 

  *If the administrator determines that the email is not safe, it will not be released.
  *If the email is not released after some time, please contact the THERS Account Help Center with the information below.

  • Date and time the email was sent
  • Sender’s email address
  • Recipient’s email address
  • Email subject
  • Whether to report the case to Microsoft as a false positive or not
    (Reporting it as a false positive may help reduce the likelihood of similar misclassifications in the future.)

  Reference: Microsoft365 Learn

  ・Manage quarantined messages and files as a user

  ・Frequently asked questions - Quarantined messages

  To check a shared mailbox, please refer to the article below.
  Reference: How to Check Quarantined Emails That Do Not Arrive in a Shared Mailbox