Applies to: Exchange Online Protection, Exchange Online
Topic Last Modified: 2013-11-11
This topic and the included video describes tasks that administrators can perform on email messages that reside in the quarantine of the Exchange admin center. For information about configuring the actions that the service performs on spam messages, including sending them to the quarantine, see Configure Content Filter Policies. Messages that are filtered due to a transport rule match can also be sent to the quarantine; for more information, see Transport Rules.
Watch the following video for a walkthrough of the quarantine and to see how you can manage messages there.
The ability to view and manage quarantined messages in the Exchange admin center is only available for administrators. |
End users can manage their own quarantined spam messages via end user-spam notification messages. For information about enabling this functionality, see Configure End-User Spam Notifications in EOP (Exchange Online Protection standalone customers) or Configure End-User Spam Notifications in Exchange Online (Exchange Online customers). For information about using this feature, see Release a Quarantined Message and Optionally Report it as a False Positive (End Users).
When messages are sent to the quarantine, you can view a list of all messages, or you can search for specific messages by specifying filter criteria. By default, quarantined messages are sorted from newest to oldest on the RECEIVED field. SENDER, SUBJECT, and EXPIRES values are also listed for each message. You can sort on any of these fields by clicking their headers. Clicking a column header a second time will reverse the sort order. A maximum of 500 messages can be displayed in the Exchange admin center. If you don’t see the message you’re looking for, you should create a filter to modify your search criteria.
For information about searching for a message, viewing details about the message after you’ve found it, and releasing the message to specified users and optionally reporting it as a false positive, see the following topics: