1 out of 2 rated this helpful - Rate this topic

Release a Quarantined Message and Optionally Report it as a False Positive

Exchange Online

Applies to: Exchange Online Protection, Exchange Online

Topic Last Modified: 2013-04-29

If a message was incorrectly identified as spam, or if it matched a transport rule, administrators can release the message from the quarantine. Spam quarantined messages can also be reported as a false positive. You can perform the following actions:

Release the message without reporting it as a false positive When you choose this option, you can specify to send the message to all recipients who have not yet received it, or to specific recipients.
Release the message and report it as a false positive When you choose this option, the message will be released to all recipients who have not yet received it. The message will also be reported to the Microsoft Spam Analysis Team.

When a message is released, the service will re-scan the released message for malware but will skip spam filtering and transport rule processing.

Note:
If you use the Move message to Junk Email folder action instead of the Quarantine message action, end users can release spam messages in their Junk Email folder in Microsoft Outlook or Microsoft Outlook Web App using the Not Junk right-click menu option. In this case, the message is not automatically submitted (reported) and must be submitted via email, as described in “Submitting False Positive Messages” in Submitting Spam Messages to Microsoft for Analysis.

Note:

If you use the Move message to Junk Email folder action instead of the Quarantine message action, end users can release spam messages in their Junk Email folder in Microsoft Outlook or Microsoft Outlook Web App using the Not Junk right-click menu option. In this case, the message is not automatically submitted (reported) and must be submitted via email, as described in “Submitting False Positive Messages” in Submitting Spam Messages to Microsoft for Analysis.

For information about searching for messages in the quarantine, see Manage Quarantined Messages.

What do you need to know before you begin?

Estimated time to complete each procedure: 5 minutes
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the “Quarantine” entry in the Feature Permissions in Exchange Online topic.
For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard Shortcuts in the Exchange Admin Center.

Tip:
Having problems? Ask for help in the Exchange forums. Visit the forums at: Exchange Server, Exchange Online, or Exchange Online Protection

What do you want to do?

Use the EAC to release a quarantined message without reporting it as a false positive

In the Exchange admin center (EAC), navigate to Protection > Quarantine.
Select a message, click the Release Message icon, and then click Release message without reporting it as a false positive from the drop-down list. (If you want to view message details before releasing the message, double-click the message to open the details window and click the Release to link.)
In the release message dialog box, select one of the following options:
1. Release message to all recipients When you select this option, be aware that a message cannot be released more than once to the same recipient. If a recipient has previously received the message, it will not be released again to that recipient.
2. Release message to specified recipients Select the user or users to whom the message can be released. Because a message can only be released once to each user, only users to whom it can be released appear in this list. Multi-selection is supported. After making your user selections, click add.
Click release.

Use the EAC to release a quarantined message to all recipients and report it as a false positive

Use the following procedure to release a quarantined message to all recipients who have not yet received it and report it as a false positive to the Microsoft Spam Analysis Team, who will evaluate and analyze the message. Depending on the results of the analysis, the service-wide spam content filter rules may be adjusted to allow the message through.

Note:
If a message was quarantined because of a transport rule or because of an advanced spam filter option (for details, see Advanced Spam Filtering Options), the message will not be evaluated. You can report a message as a false positive without releasing it by submitting it to the Microsoft Spam Analysis Team via email. For more information, see “Submitting False Positive Messages” in Submitting Spam Messages to Microsoft for Analysis.

Note:

If a message was quarantined because of a transport rule or because of an advanced spam filter option (for details, see Advanced Spam Filtering Options), the message will not be evaluated.
You can report a message as a false positive without releasing it by submitting it to the Microsoft Spam Analysis Team via email. For more information, see “Submitting False Positive Messages” in Submitting Spam Messages to Microsoft for Analysis.

In the Exchange admin center (EAC), navigate to Protection > Quarantine.
Select a message, click the Release Message icon, and then click Release message and report it as a false positive from the drop-down list. (If you want to view message details before releasing the message and reporting it as a false positive, double-click the message to open the details window and click the Report as false positive link.)
In the report false positive dialog box, click report false positive.

For more information

Manage Quarantined Messages

Quarantine

Did you find this helpful? Yes No

Not accurate

Not enough depth

Need more code examples

(1500 characters remaining)