skip to content
 

Exchange Online Protection (EOP) is a spam and malware filter available as part of the Exchange Online service. It assesses whether email is spam via both EOP's own Spam Confidence Level ruleset and the SpamAssassin scores assigned by our central mail scanner (ppswitch). Any item of mail that's ranked at a value of five or higher from either of these checks is sent to a central quarantine area, where it is retained for 15 days before being deleted.

Go to your personal quarantine page >

There is no way to disable Exchange Online's quarantine function, but there are two ways to deal with messages that have been quarantined.
 

Notification emails

You'll get a notification email from quarantine@messaging.microsoft.com listing any messages that have been quarantined in the last 24 hours – for example:

You can select the 'Release' or 'Block Sender' links in this email to accept or reject them. However, to be particularly cautious in guarding against potentially fraudulent emails, we recommend you manage your quarantined messages via your personalised web page.
 

How to use your personal Exchange Online quarantine admin web page

Your personal quarantine web page lists all the messages that have been withheld over the past 15 days (even after you have released them to your inbox).

Visit https://security.microsoft.com/quarantine

It will look like this:

 

How to release messages to your inbox

Review the items in your quarantine and ignore any junk messages. If there is a legitimate message you want to move to your Inbox click on the box to the left of the message to select it, then click on Release in the menu bar above:

 

Tip: To select multiple messages for release, you can hold down CTRL and click multiple messages or click on the box the left of 'Time received' to select all.

A message will appear to the side asking you to confirm the release, you can also tick the box here to report a false positive to Microsoft and improve the accuracy of the filter. Click the 'Release message' button at the bottom and the message will deliver to your Inbox:

A confirmation message will appear and you can click the Done button. The message will still appear in the quarantine list but the release status will have changed from 'Needs review' to 'Released'.

How to manage quarantined messages for shared mailboxes

You will need to be a member of the access group for a shared mailbox to view the quarantined messages for that mailbox. If the shared mailbox has received a notification about a quarantined message that you believe to be legitimate then open the quarantine page in a web browser: https://security.microsoft.com/quarantine

Click on the Filter option in the menu bar then enter the shared mailbox address in the 'Recepient address' field:

Click Apply and you should then see the messages quarantined for that mailbox and can follow the same steps as above to release a message.

N.B This is a new feature and we have seen permission errors when the primary address of a personal mailbox is not in the format CRSid@cam.ac.uk, if you see this error please contact the service desk for assistance (inlcude the shared mailbox address and subject line of the message you wish to be released):