You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/quarantine-faq.yml
+9-1Lines changed: 9 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -133,10 +133,14 @@ sections:
133
133
134
134
If a third party filter isn't preventing the message from reaching the user's Inbox and the first release attempt didn't work, admins can try using the [Release-QuarantineMessage](/powershell/module/exchange/release-quarantinemessage) cmdlet in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) with the _Force_ switch to release the message.
135
135
136
-
If **Release-QuarantineMessage** with the _Force_ switch doesn't work, admins should try releasing the message to an alternate mailbox after filtering by the third party service is turned off.
136
+
If **Release-QuarantineMessage** with the _Force_ switch doesn't work, admins should try releasing the message to an alternate mailbox after filtering by the third party service is turned off. Note that Force release could cause messages to be released multiple times
137
+
138
+
Note that if there is a recipient level delete that has occured on any of the messages where bulk release to all action is attempted on, it will error. The Admin needs to release that specific message only to the recipient where delete from quarantine has not taken place for
137
139
138
140
- Inbox rules ([created by users in Outlook](https://support.microsoft.com/office/c24f5dea-9465-4df4-ad17-a50704d66c59) or by admins using the **\*-InboxRule** cmdlets in Exchange Online PowerShell) can move or delete messages from the Inbox.
139
141
142
+
- Some transport rules that led to the Quarantine of a message will cause the released quaratine message to be quarantined again.
143
+
140
144
Admins can use [message trace](message-trace-defender-portal.md) to determine if a released message was delivered to the recipient's Inbox.
141
145
142
146
- question: |
@@ -159,6 +163,8 @@ sections:
159
163
160
164
For bulk actions that are available on the **Quarantine** page, see [Take action on multiple quarantined email messages](quarantine-admin-manage-messages-files.md#take-action-on-multiple-quarantined-email-messages).
161
165
166
+
P2/E5 customers they can use Threat explorer to perform larger bulk release operations (Upper limit of 200,000).
167
+
162
168
- question: |
163
169
Are wildcards supported when searching for quarantined messages? Can I search for quarantined messages for a specific domain?
164
170
answer: |
@@ -210,6 +216,8 @@ sections:
210
216
> The fastest, most frequent notification schedule that's available is every four hours.
211
217
>
212
218
> If you select every four hours, and a message is quarantined _just after_ the last notification generation, the recipient will receive the quarantine notification _slightly more than_ four hours later.
219
+
>
220
+
> for messages zapped to Quarantine, Quarantine notifications are generated in accordance to the time the messages landed in Quarantine (not when it landed inbox)
213
221
214
222
- question: |
215
223
Why aren't users receiving notifications about their quarantined messages?
0 commit comments