Microsoft Defender Quarantine - FAQ

Microsoft Defender Quarantine is a feature that is integrated with Outlook to protect users from harmful emails and spam. It automatically holds suspicious emails in quarantine until the user can review them and decide whether to allow them to be delivered to their inbox or to delete them. 

By enabling Defender Quarantine on the Outlook client, OIT is empowering end users to release messages they previously would not have seen. 

Yes, Microsoft Defender Quarantine was enabled campuswide on June 6, 2023. 

The junk email folder is only intended for email that is considered “bulk” email (such as surveys or advertisements) while the Quarantine is intended to prevent harmful emails from ever reaching your inbox. Occasionally emails that are not harmful could end up in the Quarantine, but over time Microsoft is working to improve their detection techniques. 

Quarantine items are available for 30 days. After 30 days, these emails expire and cannot be reviewed or released.

You will receive a notice daily, but you can check your quarantine at any time by visiting https://security.microsoft.com/quarantine.

We don’t currently have an opt-out process for the Quarantine notifications, but you can use Outlook to create a rule and automatically delete these emails. Use our Outlook on the Web or Microsoft Outlook Desktop inbox rule tutorials to learn how. 
 

It's recommended to check your quarantine regularly to ensure that no legitimate emails are being blocked. If you ignore Quarantined emails that you don’t want to receive, those emails will expire and are deleted automatically after 30 days.

To preview an email in quarantine, log into https://security.microsoft.com/quarantine, select the email and click on the Preview button.

To release an email from quarantine, log into https://security.microsoft.com/quarantine, select the email, and click on the "Release" button if it is available. The email will then be delivered to your inbox. If a message is determined to have a high probability of being harmful, it will require OIT administrator intervention before being released to your inbox. 

Messages may also be released directly from the Quarantine notification emails. 

To delete an email from quarantine, log into https://security.microsoft.com/quarantine, select the email and click the Delete button. Messages may also be deleted directly from the Quarantine notification email.

The safe senders list is a feature used in Microsoft Defender Quarantine to ensure that emails from specific senders are not placed in quarantine. This feature can be useful for safelisting emails from known business partners, colleagues, or other important contacts. While the Safe Senders list can help reduce the chances of legitimate emails being quarantined, it doesn't guarantee that all emails from those senders will be safe, so it's still important to review your quarantine regularly and be vigilant against potential phishing or malicious emails. 

• Log in to your Outlook Web Account, click on the Settings icon in the top right corner of the screen.
• Click on View all Outlook settings
• Click on Mail
• Click on Junk email

From this menu you can search, add, and delete users from your Safe Senders list. 

While Microsoft states the domains may be added to the safe senders list, currently users must add specific email addresses to the safe senders list.

Legitimate messages may appear in the Quarantine if the sender was accidentally placed on your Blocked Senders list.

• To unblock a legitimate sender, log in to your Outlook Web Account, click on the "Settings" icon in the top right corner of the screen
• Click on View all Outlook settings
• Click Mail
• Then click on Junk email.
• From this menu you can search, add, and delete users from your Blocked Senders list. It's also recommended to review your Blocked Senders list regularly to ensure that no legitimate emails are being blocked.

If a message is determined to have a high probability of being harmful, it will require OIT administrator intervention before being released to your inbox. Please allow for one business day for these emails to be reviewed and released to you if they were false positives.

Yes, you can block a specific user or email address in the Quarantine tab, which will prevent any future emails from that user or address from being delivered to your inbox. You can also right click emails in your inbox and select either “Block then Block Sender or Junk then Block Sender depending on your client. Visit our Edit your safe and blocked users list tutorial for screenshots of this process. 

Please contact the IT Service Center at 303-735-4357 or oithelp@colorado.edu.