You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Release date: **August 7, 2024** (Engine and Platform)
105
+
- Platform: **4.18.24070.5**
106
+
- Engine: **1.1.24070.3**
107
+
- Support phase: **Security and Critical Updates**
108
+
109
+
### What's new
110
+
111
+
- False positive detections are no longer reported as `ThreatNotFound` in the Microsoft Defender portal.
112
+
- Optimized Network Protection calls to the backend that occur as a result of suspicious connection checks.
113
+
- Fixed the [PerformanceModeStatus](/windows/client-management/mdm/defender-csp#configurationperformancemodestatus) configuration key in Defender CSP so changing this value in the console takes effect on the endpoint.
114
+
- Resolved an issue where File Evidence Location was not always captured in scenarios where the Remote Location is inaccessible.
115
+
- New event log added (5016) to report Microsoft Defender Antivirus self-healed when a deadlock is detected during shutdown.
116
+
- Fixed a prioritization issue with full scans initiated from the portal that resulted in longer than expected full scan duration.
- Support phase: **Technical upgrade support (only)**
39
+
40
+
#### What's new
41
+
42
+
- Added an opt-out feature for Experimental Configuration Services (ECS) and One collector in the Core Service.
43
+
- Fixed an issue where occasionally exclusions deployed via Intune were not being honored when tamper protection was enabled.
44
+
- After a new engine version is released, support for older versions (N-2) will now reduce to technical support only. Engine versions older than N-2 are no longer supported.
45
+
- Improved health monitoring and telemetry for [attack surface rules](overview-attack-surface-reduction.md) exclusions.
46
+
- Updated inaccurate information in [Configure exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) regarding wildcard usage with contextual exclusions.
Copy file name to clipboardExpand all lines: defender-office-365/quarantine-admin-manage-messages-files.md
+8-4Lines changed: 8 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ ms.custom:
18
18
- seo-marvel-apr2020
19
19
description: Admins can learn how to view and manage quarantined messages for all users in Exchange Online Protection (EOP). Admins in organizations with Microsoft Defender for Office 365 can also manage quarantined files in SharePoint Online, OneDrive for Business, and Microsoft Teams.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -88,6 +88,8 @@ Watch this short video to learn how to manage quarantined messages as an admin.
88
88
89
89
In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Email & collaboration**\>**Review**\>**Quarantine**\>**Email** tab. Or, to go directly to the **Email** tab on the **Quarantine** page, use <https://security.microsoft.com/quarantine?viewid=Email>.
90
90
91
+
By default, only the first 100 entries are shown until you scroll down to the bottom of the list, which loads more results.
92
+
91
93
On the **Email** tab, you can decrease the vertical spacing in the list by clicking :::image type="icon" source="media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal** and then selecting :::image type="icon" source="media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**.
92
94
93
95
You can sort the entries by clicking on an available column header. Select :::image type="icon" source="media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (<sup>\*</sup>):
@@ -206,7 +208,7 @@ In the details flyout that opens, the following information is available:
206
208
-**Policy type**
207
209
-**Policy name**
208
210
-**Recipient count**
209
-
-**Recipients**: If the message contains multiple recipients, you might need to use [Preview message](#preview-email-from-quarantine) or [View message header](#view-email-message-headers) to see the complete list of recipients.
211
+
-**Recipients**: If the message contains many recipients, you can use [Preview message](#preview-email-from-quarantine) or [View message header](#view-email-message-headers) to see the complete list of recipients.
210
212
211
213
Recipient email addresses always resolve to the primary email address, even if the message was sent to a [proxy address](/exchange/recipients-in-exchange-online/manage-user-mailboxes/add-or-remove-email-addresses).
212
214
@@ -489,14 +491,16 @@ In organizations with Microsoft Defender for Office 365 (add-on licenses or incl
489
491
490
492
#### Take action on multiple quarantined email messages
491
493
492
-
When you select multiple quarantined messages on the **Email** tab by selecting the check boxes next to the first column, the following bulk actions are available on the **Email** tab (depending on the **Release status** values of the messages that you selected):
494
+
When you select up to 100 quarantined messages on the **Email** tab by selecting the check boxes next to the first column, the following bulk actions are available on the **Email** tab (depending on the **Release status** values of the messages that you selected):
The only available options to select for bulk actions are **Send a copy of this message to other recipients in your organization** and **Send the message to Microsoft to improve detection (false positive)**.
497
499
498
500
-[Approve or deny release requests from users for quarantined email](#approve-or-deny-release-requests-from-users-for-quarantined-email)
501
+
499
502
-[Delete email from quarantine](#delete-email-from-quarantine)
503
+
500
504
-[Report email to Microsoft for review from quarantine](#report-email-to-microsoft-for-review-from-quarantine)
501
505
502
506
The only available options to select for bulk actions are **Allow emails with similar attributes** and the related **Remove allow entry after** and **Allow entry note** options.
@@ -520,7 +524,7 @@ Admins can search the audit log to find events for messages that were deleted fr
520
524
521
525
-**Date and time range (UTC)**
522
526
-**Activities - friendly names**: Click in the box, start typing "quarantine" in the :::image type="icon" source="media/m365-cc-sc-search-icon.png" border="false"::: **Search** box that appears, and then select **Deleted Quarantine message** from the results.
523
-
-**Users**: If know who deleted the message from quarantine, you can further filter the results by user.
527
+
-**Users**: If you know who deleted the message from quarantine, you can further filter the results by user.
524
528
525
529
3. When you're finished entering the search criteria, select **Search** to generate the search.
Copy file name to clipboardExpand all lines: defender-office-365/quarantine-faq.yml
+31-19Lines changed: 31 additions & 19 deletions
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ metadata:
6
6
ms.author: chrisda
7
7
author: chrisda
8
8
manager: deniseb
9
-
ms.date: 08/05/2024
9
+
ms.date: 08/07/2024
10
10
audience: ITPro
11
11
ms.topic: faq
12
12
@@ -81,7 +81,7 @@ sections:
81
81
82
82
If the quarantine policy requires users to request the release of messages or requires admins to release messages, an admin must [approve the release request](quarantine-admin-manage-messages-files.md#approve-or-deny-release-requests-from-users-for-quarantined-email) or [release the message](quarantine-admin-manage-messages-files.md#release-quarantined-email) before the message is available to users.
83
83
84
-
You can't customize quarantine policies in preset security policies.
84
+
You can't customize quarantine policies in [preset security policies](preset-security-policies.md).
85
85
86
86
87
87
- question: |
@@ -96,7 +96,9 @@ sections:
96
96
- question: |
97
97
How can I prevent users from accessing quarantined messages?
98
98
answer: |
99
-
The default quarantine policy named AdminOnlyAccessPolicy prevents any user interaction with their quarantined messages. By default, this quarantine policy is used for messages that were quarantined as malware or high confidence phishing. In custom policies or the default policy for [protection features that support quarantining messages](quarantine-policies.md#step-2-assign-a-quarantine-policy-to-supported-features), admins can specify the AdminOnlyAccessPolicy as the quarantine policy to use. You can prevent end users from accessing `security.microsoft.com/quarantine`.
99
+
The default quarantine policy named AdminOnlyAccessPolicy prevents any user interaction with their quarantined messages. By default, this quarantine policy is used for messages that were quarantined as malware or high confidence phishing. In custom policies or the default policy for [protection features that support quarantining messages](quarantine-policies.md#step-2-assign-a-quarantine-policy-to-supported-features), admins can specify the AdminOnlyAccessPolicy as the quarantine policy to use.
100
+
101
+
You can't prevent end users from seeing or accessing the **Quarantine** page at <https://security.microsoft.com/quarantine>.
100
102
101
103
- question: |
102
104
How do I find out why a message was quarantined?
@@ -114,7 +116,7 @@ sections:
114
116
115
117
When a message expires from quarantine, you can't recover it.
116
118
117
-
By default, messages from blocked senders are hidden from view in quarantine. Users need to select **Filter** and then deselect **Don't show blocked senders** to see all messages coming from blocked senders.
119
+
By default, messages from blocked senders are hidden from view in quarantine (quarantine is filtered by **Don't show blocked senders**). To see messages from all senders, select :::image type="icon" source="media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** and then select **Show all senders**.
118
120
119
121
- question: |
120
122
A message was released from quarantine, but the original recipient can't find it. How can I determine what happened to the message?
@@ -126,9 +128,9 @@ sections:
126
128
127
129
Verify that you aren't using third party filtering before you open a support ticket about these issues.
128
130
129
-
If a third party filter isn't preventing the message from reaching the user's Inbox, then admins can use force release functionality to release message (if the first release didn't work).
131
+
If a third party filter isn't preventing the message from reaching the user's Inbox and the first release attempt didn't work, admins can try using the [Release-QuarantineMessage](/powershell/module/exchange/release-quarantinemessage) cmdlet in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) with the _Force_ switch to release the message.
130
132
131
-
Admin should try to release the message to an alternate mailbox if the forced release doesn't work after third party filtering vendor is turned off.
133
+
If **Release-QuarantineMessage** with the _Force_ switch doesn't work, admins should try releasing the message to an alternate mailbox after filtering by the third party service is turned off.
132
134
133
135
- Inbox rules ([created by users in Outlook](https://support.microsoft.com/office/c24f5dea-9465-4df4-ad17-a50704d66c59) or by admins using the **\*-InboxRule** cmdlets in Exchange Online PowerShell) can move or delete messages from the Inbox.
134
136
@@ -141,7 +143,9 @@ sections:
141
143
142
144
Verify that you aren't using third party filtering before you open a support ticket about this issue.
143
145
144
-
Admins can also use the audit log to see who released a message from Quarantine.
146
+
Quarantined messages that have been released have the **Status** value **Released** and the **Released by** property available on the **Quarantine** page.
147
+
148
+
Admins can also use the audit log to see who released a message from Quarantine. Use the value **Released Quarantine message** in **Activities - friendly names**. For related instructions, see [Find who deleted a quarantined message](quarantine-admin-manage-messages-files.md#find-who-deleted-a-quarantined-message).
145
149
146
150
- question: |
147
151
Can I release or report more than one quarantined message at a time?
@@ -150,7 +154,7 @@ sections:
150
154
151
155
Admins can use the [Get-QuarantineMessage](/powershell/module/exchange/get-quarantinemessage) and [Release-QuarantineMessage](/powershell/module/exchange/release-quarantinemessage) cmdlets in Exchange Online PowerShell or standalone EOP PowerShell to find and release quarantined messages in bulk, and to report false positives in bulk.
152
156
153
-
Admins can also bulk delete messages.
157
+
For bulk actions that are available on the **Quarantine** page, see [Take action on multiple quarantined email messages](quarantine-admin-manage-messages-files.md#take-action-on-multiple-quarantined-email-messages).
154
158
155
159
- question: |
156
160
Are wildcards supported when searching for quarantined messages? Can I search for quarantined messages for a specific domain?
@@ -225,8 +229,6 @@ sections:
225
229
answer: |
226
230
See the permissions entry [here](quarantine-admin-manage-messages-files.md#what-do-you-need-to-know-before-you-begin).
227
231
228
-
Admins can release quarantined messages to external recipients that aren't in their organization.
229
-
230
232
> [!TIP]
231
233
> The ability to manage quarantined messages using [Exchange Online permissions](/exchange/permissions-exo/permissions-exo) ended in February 2023 per MC447339.
232
234
>
@@ -243,35 +245,45 @@ sections:
243
245
If a user deletes the message from the Teams client, the message is gone, so Preview isn't available in quarantine for the deleted message.
244
246
245
247
- question: |
246
-
I can't see the **Block sender** button or the **Approve release** button. What's going on?
248
+
I don't see the **Block sender** button in quarantine notifications or on the **Quarantine page**. I also don't see the **Approve release** button on the **Quarantine page**. What's going on?
247
249
answer: |
248
-
The **Block sender** action is disabled by default for quarantined messages. However, admins can create a custom quarantine policy to include the **Block sender** action for end users.
250
+
**Block sender** is disabled by default for quarantined messages.
251
+
252
+
For end users, admins can create and assign a custom quarantine policy that includes the **Block sender** action. For more information, see [Quarantine policies](quarantine policies).
253
+
254
+
Admins see **Block sender** only if they filter the quarantine results by **Recipient** \> **Only me** instead of the default value **All users**.
249
255
250
-
The **Approve release** button has been retired and replaced by the **Release** button.
256
+
**Approve release** has been retired and is now included in :::image type="icon" source="media/m365-cc-sc-check-mark-icon.png" border="false"::: **Release**.
251
257
252
258
- question: |
253
259
**Filter** and **Search** aren't working. What's going on?
254
260
answer: |
255
-
The **Search** box applies to loaded quarantine messages only.
261
+
The **Search** box applies to the visible results in quarantine. By default, only the first 100 entries are shown until you scroll down to the bottom of the list, which loads more results.
256
262
257
-
To filter by Internet Message ID, you need to ensure that angle brackets `<>` are always inluded (even in PowerShell).
263
+
To filter quarantined messages by Internet Message ID, the value must include angle brackets (`<>`), even in PowerShell.
258
264
259
265
- question: |
260
266
Released quarantine messages are still showing up in Quarantine. What's going on?
261
267
answer: |
262
-
Released messages remain visible in quarantine unless they're explicitly deleted from quarantine.
268
+
Released messages remain visible in quarantine with the **Status** value **Released**, until:
269
+
270
+
- The [quarantine retention period](quarantine-about.md#quarantine-retention) expires and the message is automatically deleted.
271
+
272
+
or
273
+
274
+
- The message is manually deleted from quarantine.
263
275
264
276
- question: |
265
277
Release request alerts aren't being generated. What's going on?
266
278
answer: |
267
-
Audit logging needs to be enabled (it's on by default).
279
+
Audit logging needs to be turned on (it's on by default). For more information, see [Turn auditing on or off](/purview/audit-log-enable-disable).
268
280
269
281
- question: |
270
282
Duplicate or multiple quarantine notifications are sent to the same user.
271
283
answer: |
272
-
Mutiple or duplicate quarantine notifications are sent if the SendFromAliasEnabled paraMETER value is True.
284
+
Multiple or duplicate quarantine notifications are sent to the same user if the [SendFromAliasEnabled parameter](/powershell/module/exchange/set-organizationconfig#-sendfromaliasenabled) on the **Set-OrganizationConfig** cmdlet in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) is set to the value $true.
273
285
274
286
- question: |
275
287
I can't see all recipients of a quarantined message. What's going on?
276
288
answer: |
277
-
For quarantine messages with a large number of recipients, we don't show all of the recipients. However, admins can use **View message header** or **Preview message** to see all recipients.
289
+
Admins can use [Preview message](quarantine-admin-manage-messages-files.md#preview-email-from-quarantine) or [View message header](quarantine-admin-manage-messages-files.md#view-email-message-headers) to see the complete list of recipients.
0 commit comments