Release an Email From Microsoft Defender Quarantine

Release an Email From Microsoft Defender Quarantine

Overview

Microsoft Defender for Office 365 holds suspicious messages in Quarantine before they ever reach your inbox. Most of what lands there really is spam or phishing — but every so often, a real message gets caught. This guide shows you how to find quarantined mail and release it safely.

Before You Begin

  • A work account at a company that uses Microsoft Defender for Office 365.
  • A recent quarantine notification email, or your work email and password.
  • A few minutes to review the message before releasing it.

Steps

Option 1: Use the Quarantine Notification Email

  1. Open the quarantine notification from quarantine@messaging.microsoft.com in your inbox. Microsoft sends these on a schedule.
  2. Find the message in the list.
  3. Click Review message or Release next to that message.
  4. The Microsoft 365 portal opens in your browser. Sign in if prompted.
  5. Approve the multi-factor authentication prompt.
  6. Confirm the action and click Release.

Option 2: Visit the Quarantine Portal Directly

  1. Open a browser and go to https://security.microsoft.com/quarantine.
  2. Sign in with your work email and password. Approve the multi-factor authentication prompt.
  3. The quarantine list shows messages held for your account.
  4. Click a message to preview it.
  5. Look at the sender address (not only the display name) and the subject. If anything looks off, do not release it.
  6. Click Release email.
  7. Pick whether to also report the message as a false positive to Microsoft. This helps train the filter.
  8. Click Release. The message arrives in your inbox within a few minutes.

How to Tell if a Quarantined Message Is Safe to Release

  • Sender domain matches the real company (for example, billing@realvendor.com, not billing@realvendor-support.xyz).
  • You were expecting it, or it is from someone you recognize.
  • Links and attachments make sense for the context. A vendor sending an invoice is normal; a vendor sending a password-reset link out of nowhere is not.
  • No urgent threats ("act now or lose access") or unusual requests for credentials.

If you are unsure, leave the message in quarantine and submit a ticket. We would rather review one false positive than release one phishing attempt.

Troubleshooting

  • If you cannot sign in to the portal: confirm your account at mysignins.microsoft.com. Your administrator may need to grant quarantine review permission.
  • If the released message still does not appear: wait 10 minutes, then check Junk Email and your Inbox. If it is still missing, submit a ticket.
  • If the same sender keeps getting quarantined: ask your administrator to add the sender to the organization's allow list. Do not maintain a personal safe-senders list for repeat business contacts — it is more reliable at the tenant level.
  • If you released something and now suspect it was phishing: report it immediately using the Report → Phishing button in Outlook, then change your password and submit a ticket.

Related Articles

Need More Help?

Submit a ticket at support.bostonmit.com or email support@bostonmit.com.