Merge pull request #2393 from MicrosoftDocs/QuarRR-chrisda

QuarRR-chrisda to Main

Author: chrisda

defender-office-365/media/quarantine-message-bulk-actions.png

@@ -163,7 +163,6 @@ To filter the entries, select :::image type="icon" source="media/m365-cc-sc-filt
 
 - **Release status**: Select one or more of the following values
   - **Needs review**
-  - **Approved**
   - **Denied**
   - **Release requested**
   - **Released**
@@ -305,7 +304,7 @@ In the **Release email to recipient inboxes** flyout that opens, configure the f
   - **Release to all recipients**
   - **Release to one or more of the original recipients of the email**: Enter the recipients in the **Recipients** box that appears.
 
-- **Send a copy of this message to another recipient**: If you select this option, select one or more recipients by clicking in the **Recipients** box that appears.
+- **Send a copy of this message to another recipient**: If you select this option, select one or more recipients by clicking in the **Recipients** box that appears. Select :::image type="icon" source="media/m365-cc-sc-remove-selection-icon.png" border="false"::: to remove an entry.
 
 - **Submit the message to Microsoft to improve detection**: If you select this option, the erroneously quarantined message is reported to Microsoft as a false positive. Depending on the results of their analysis, the service-wide spam filter rules might be adjusted to allow the message through.
 
@@ -332,12 +331,16 @@ If you don't release or remove a message, it's automatically deleted from quaran
 
 After you select the message, use either of the following methods to approve or deny the release request:
 
-- **On the Email tab**: Select :::image type="icon" source="media/m365-cc-sc-edit-icon.png" border="false"::: **Approve release** or :::image type="icon" source="media/m365-cc-sc-deny-icon.png" border="false"::: **Deny**.
-- **In the details flyout of the selected message**: Select :::image type="icon" source="media/m365-cc-sc-more-actions-icon.png" border="false"::: **More** and then select **Approve release** or :::image type="icon" source="media/m365-cc-sc-deny-icon.png" border="false"::: **Deny release**.
+- **On the Email tab**: Select :::image type="icon" source="media/m365-cc-sc-check-mark-icon.png" border="false"::: **Release** or :::image type="icon" source="media/m365-cc-sc-deny-icon.png" border="false"::: **Deny**.
+- **In the details flyout of the selected message**: Select :::image type="icon" source="media/m365-cc-sc-check-mark-icon.png" border="false"::: **Release email** or :::image type="icon" source="media/m365-cc-sc-more-actions-icon.png" border="false"::: **More** \> :::image type="icon" source="media/m365-cc-sc-deny-icon.png" border="false"::: **Deny release**.
 
-If you select **Approve release**, an **Approve release** flyout opens where you can review information about the message. To approve the request, select **Approve release**. A **Release approved** flyout opens where you can select the link to learn more about releasing messages. Select **Done** when you're finished on the **Release approved** flyout. Back on the **Email** tab, the **Release status** value of the message changes to **Approved**.
+If you select **Release** or **Release email**, a **Release email to recipient inboxes** flyout opens. The options are the same as described in [Release quarantined email](#release-quarantined-email).
 
-If you select **Deny**, a **Deny release** flyout opens where you can review information about the message. To deny the request, select **Deny release**. A **Release denied** flyout opens where you can select the link to learn more about releasing messages. Select **Done** when you're finished on the **Release denied** flyout. Back on the **Email** tab, the **Release status** value of the message changes to **Denied**.
+After you release the message, the **Release status** value of the message changes to **Released** on the **Email** tab.
+
+If you select **Deny** or **Deny release**, a **Deny release** flyout opens where you can review information about the message. When you select **Deny release**, a **Release denied** flyout opens where you can select the link to learn more about releasing messages. Select **Done** when you're finished on the **Release denied** flyout.
+
+Back on the **Email** tab, the **Release status** value of the message changes to **Denied**.
 
 > [!TIP]
 > You can deny release for all recipients only. You can't deny release for specific recipients.
@@ -385,9 +388,9 @@ Use :::image type="icon" source="media/m365-cc-sc-copy-icon.png" border="false":
 
 Select the **Microsoft Message Header Analyzer** link to analyze the header fields and values in depth. Paste the message header into the **Insert the message header you would like to analyze** section (CTRL+V or right-click and choose **Paste**), and then select **Analyze headers**.
 
-#### Report email to Microsoft for review from quarantine
+#### Submit email to Microsoft for review from quarantine
 
-After you select the message, use either of the following methods to report the message to Microsoft for analysis:
+After you select the message, use either of the following methods to submit the message to Microsoft for analysis:
 
 - **On the Email tab**: Select :::image type="icon" source="media/m365-cc-sc-more-actions-icon.png" border="false"::: **More** \> :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Submit for review**.
 - **In the details flyout of the selected message**: Select :::image type="icon" source="media/m365-cc-sc-more-actions-icon.png" border="false"::: **More options** \> :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Submit for review**.
@@ -505,19 +508,21 @@ In organizations with Microsoft Defender for Office 365 (add-on licenses or incl
 
 When you select up to 100 quarantined messages on the **Email** tab by selecting the check boxes next to the first column, the following bulk actions are available on the **Email** tab (depending on the **Release status** values of the messages that you selected):
 
-- [Release quarantined email](#release-quarantined-email)
+- [Release quarantined email messages](#release-quarantined-email):
+  - Not available for messages with the **Release status** value **Released**.
+  - [Approve user release requests](#approve-or-deny-release-requests-from-users-for-quarantined-email) if the **Release status** value of the messages is **Released requested**.
 
-  The only available options to select for bulk actions are **Send a copy of this message to other recipients in your organization** and **Send the message to Microsoft to improve detection (false positive)**.
+  The only available options to select for bulk actions are **Send a copy of this message to other recipients** and **Send the message to Microsoft to improve detection (false positive)**.
 
 - [Approve or deny release requests from users for quarantined email](#approve-or-deny-release-requests-from-users-for-quarantined-email)
 
 - [Delete email from quarantine](#delete-email-from-quarantine)
 
-- [Report email to Microsoft for review from quarantine](#report-email-to-microsoft-for-review-from-quarantine)
+- [Submit email messages to Microsoft for review](#submit-email-to-microsoft-for-review-from-quarantine)
 
   The only available options to select for bulk actions are **Allow emails with similar attributes** and the related **Remove allow entry after** and **Allow entry note** options.
 
-- [Download email from quarantine](#download-email-from-quarantine)
+- [Download email messages from quarantine](#download-email-from-quarantine)
 
 :::image type="content" source="media/quarantine-message-bulk-actions.png" alt-text="Screenshot of the available actions on the Email tab of the Quarantine page after you select the check box of multiple quarantined messages." lightbox="media/quarantine-message-bulk-actions.png":::
 
@@ -801,12 +806,12 @@ This action isn't available for Teams messages that have already been released (
 
 If you don't release or remove a message, it's automatically deleted from quarantine after the date shown in the **Expires** column.
 
-After you select the message, use either of the following methods to release it:
+After you select the message, use either of the following methods to release it to all chat participants:
 
 - **On the Teams messages tab**: Select :::image type="icon" source="media/m365-cc-sc-check-mark-icon.png" border="false"::: **Release**.
 - **In the details flyout of the selected message**: Select :::image type="icon" source="media/m365-cc-sc-check-mark-icon.png" border="false"::: **Release**.
 
-In the **Release to all chat participants** flyout that opens, decide whether to select **Submit the message to Microsoft to improve detection (false positive)**, and then select **Release**.
+In the **Release message to your Teams app** flyout that opens, decide whether to select **Submit the message to Microsoft to improve detection (false positive)**, and then select **Release**.
 
 #### Delete Teams messages from quarantine
 
@@ -833,9 +838,9 @@ In the flyout that opens, choose one of the following tabs:
 - **Source**: Shows the HTML version of the message body with all links disabled.
 - **Plain text**: Shows the message body in plain text.
 
-#### Report Teams messages to Microsoft for review from quarantine
+#### Submit Teams messages to Microsoft for review from quarantine
 
-After you select the message, use either of the following methods to report the message to Microsoft for analysis:
+After you select the message, use either of the following methods to submit the message to Microsoft for analysis:
 
 - **On the Teams messages tab**: Select :::image type="icon" source="media/m365-cc-sc-more-actions-icon.png" border="false"::: **More** \> :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Submit for review**.
 - **In the details flyout of the selected message**: Select :::image type="icon" source="media/m365-cc-sc-more-actions-icon.png" border="false"::: **More options** \> :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Submit for review**.
@@ -866,7 +871,7 @@ When you select multiple quarantined messages on the **Teams messages** tab by s
 
 - [Release quarantined Teams messages](#release-quarantined-teams-messages)
 - [Delete Teams messages from quarantine](#delete-teams-messages-from-quarantine)
-- [Report Teams messages to Microsoft for review from quarantine](#report-teams-messages-to-microsoft-for-review-from-quarantine)
+- [Submit Teams messages to Microsoft for review from quarantine](#submit-teams-messages-to-microsoft-for-review-from-quarantine)
 - [Download Teams messages from quarantine](#download-teams-messages-from-quarantine)
 
 :::image type="content" source="media/quarantine-teams-bulk-action.png" alt-text="Screenshot of the available actions on the Teams messages tab of the Quarantine page after you select multiple quarantined Teams messages." lightbox="media/quarantine-teams-bulk-action.png":::

defender-office-365/media/quarantine-message-details-flyout-actions.png

@@ -49,7 +49,7 @@ Watch this video that shows more information about the unified submissions exper
 |[The built-in Report button in supported versions of Outlook](submissions-outlook-report-messages.md#use-the-built-in-report-button-in-outlook)|User||
 |[The Microsoft Report Message and Report Phishing add-ins](submissions-outlook-report-messages.md#use-the-report-message-and-report-phishing-add-ins-in-outlook)|User|These free add-ins work in Outlook on all available platforms. For installation instructions, see [Enable the Report Message or the Report Phishing add-ins](submissions-users-report-message-add-in-configure.md).|
 |[The Submissions page in the Microsoft Defender portal](submissions-admin.md)|Admin|Admins can report good (false positives) and bad (false negative) messages, email attachments, and URLs (entities) from the available tabs on the **Submissions** page. <br><br> Admins can also submit user reported messages from the **User reported** tab on the **Submissions** page to Microsoft for analysis. The **Submissions** page is available only in organizations with Exchange Online mailboxes as part of a Microsoft 365 subscription (not available in standalone EOP).|
-|Report messages from quarantine|Admin and User|Admins can [submit quarantined messages to Microsoft for analysis](quarantine-admin-manage-messages-files.md#report-email-to-microsoft-for-review-from-quarantine) (false positives and false negatives). <br><br> If users are allowed to [release their own messages from quarantine](quarantine-end-user.md#release-quarantined-email), and [user reported settings](submissions-user-reported-messages-custom-mailbox.md) is configured to allow users to report quarantined messages, users can select **Report message as having no threats** (false positive) when they release a quarantined message.|
+|Report messages from quarantine|Admin and User|Admins can [submit quarantined messages to Microsoft for analysis](quarantine-admin-manage-messages-files.md#submit-email-to-microsoft-for-review-from-quarantine) (false positives and false negatives). <br><br> If users are allowed to [release their own messages from quarantine](quarantine-end-user.md#release-quarantined-email), and [user reported settings](submissions-user-reported-messages-custom-mailbox.md) is configured to allow users to report quarantined messages, users can select **Report message as having no threats** (false positive) when they release a quarantined message.|
 
 ## Related reporting settings for admins