Emails Quarantined by Microsoft
The Microsoft quarantine page shows emails identified and quarantined by Microsoft 365 over the last 14-30 days, depending on how Microsoft 365 is configured.
To use this feature, Barracuda Networks requires access to emails quarantined by Microsoft 365. If a pink banner is visible at the top of any Impersonation Protection page, click Accept permissions and follow the steps to allow Impersonation Protection to access Microsoft 365 quarantine information. Learn more about permissions requested by Barracuda Networks.
This short video demonstrates the unified quarantine experience provided by Barracuda Networks.
An empty Microsoft quarantine table can occur if either of these are true:
Permissions for the latest Impersonation Protection features have not been granted. In this scenario a pink banner will be visible at the top of any Impersonation Protection page. You can click Accept permissions and follow the steps to allow Impersonation Protection to access Microsoft 365 quarantine information.
Impersonation Protection onboarding recently completed or permissions were recently granted. Please check back in a short while. Impersonation Protection is in the process of gathering quarantine data from Microsoft 365.
Each row contains an email quarantined for an individual recipient. Therefore, an email sent to multiple recipients will show up in this table as multiple rows.
Example: An email is sent to Ted, Dana, and Bob. Based on Microsoft 365 settings, it is quarantined for Dana and Bob. It will show up in this table in two rows - once for Dana and once for Bob.
Table columns are as follows:
Date – The date and time the message was quarantined by Microsoft 365. The table can be sorted from newest to oldest or oldest to newest by clicking the Date column header.
Employee – This is the intended recipient of the email.
Email – This column shows the email sender and the subject.
MSFT Determination – The threat type as determined by Microsoft (Malware, Spam, etc.)
Action by – Shows the admin that has taken the release action on the email. If the action was taken outside of Impersonation Protection, Microsoft Defender will show as the action taker.
The last column shows actions that either were taken or can be taken with an email. An action can be to view an email's details
, release an email
, or delete
it.
Syncing table data
Microsoft quarantine data is updated every two hours.
Last sync shows the last time the Microsoft Quarantine table pulled in fresh table data.
Click the Refresh button to bypass the usual update time and immediately draw the latest Microsoft quarantined messages.
Note: the refresh can take up to three minutes.
Finding specific emails
Search – Enter all or part of an email subject or sender address to find matching emails. The matching text will be highlighted.
Search results can be further refined by filtering with the Microsoft’s Determination dropdown. See Combining filters and search for more information.
Filtering table results by Microsoft Determination
Click on the dropdown at top-right of the table to see the list of Microsoft determinations. This is a list of reasons–or verdicts–for which Microsoft 365 quarantined messages.
Select an option on this list to see only the emails quarantined for that reason. Options include:
All MSFT determinations – (default) Emails quarantined by Microsoft 365 for any reason.
Admin action - File type block – The email contains a blocked file type/extension or other disallowed file characteristics. Examples could include executables (.exe) or archive files or scripts.
Bulk – Matching patterns typical of mass mailing (e.g., likely sent to many recipients or content characteristics consistent with spamming a large number of targets.)
Data Loss Prevention – Email matching a Data Loss Prevention (DLP) policy. This may involve sensitive data patterns (e.g., credit card numbers), specific information types (e.g., financial or health-related), or configured keywords.
High confidence phishing – Microsoft is highly certain the email is phishing (see phishing description below).
Malware – Contains or links to content associated with malicious software.
Phishing – A nefarious actor impersonates trusted entities-such as banks, government agencies, or tech companies-to steal sensitive data, login credentials, or money.
SharePoint malware – The email links to malware hosted in SharePoint.
Spam – Suspicious content or headers, from a suspicious source or sender with a poor reputation, or other spam-like signals.
Transport rule – Email matched a rule configured by a Microsoft 365 admin.
Results can be further refined with use of the Search field. See Combining filters and search for more information.
Combining filters and search
The Microsoft Determinations dropdown list and the Search field can work together to more precisely narrow table results. Simply choose an option from the Microsoft Determinations dropdown and then add a keyword in the Search field to match an email subject or sender address.
Email details
Click the details icon
Deleting emails
Deleting an email removes it from Microsoft 365 and ensures the intended recipient never receives it.
Click the garbage can icon
Deleting… is displayed until Impersonation Protection confirms that Microsoft 365 has deleted the message.
Once the delete process is complete, confirmation will be displayed for a moment and then that row will be removed from the Microsoft quarantine list.
Messages are deleted for one recipient at a time. Each row in the table shows an email for a single recipient. Clicking the garbage can icon will delete the email for only that recipient.
In the unlikely event that an error occurs during the delete process, Email not deleted will display.
Releasing emails
Releasing an email removes it from Microsoft 365 quarantine and sends it on its way towards the message recipient. Barracuda Networks will then apply its own AI powered scanning and analysis of the email and determine if it is suitable for delivery.
Click the arrow icon
Email Released is then shown for that email.
Released messages remain in the Microsoft quarantine table for the same duration as they do in Microsoft 365’s quarantine (14-30 days).
Messages are released for one recipient at a time. Each row in the table shows an email for a single recipient. Clicking the arrow icon will release the email for only that recipient.
If an error occurs during the release process, Email not released will display.
One reason an error may occur is if the email was already deleted from Microsoft 365. See below for more information.
Emails deleted from within Microsoft 365
An email that has been deleted from the Microsoft 365 interface can still be displayed in the Impersonation Protection Microsoft quarantine table for up to 24 hours. Clicking to release such an email will result in an error and Email not released will be displayed. Clicking to delete such an email will simply remove the row from the table.
Emails released from within Microsoft 365
An email that has been released from the Microsoft 365 interface can take up to 24 hours to show as released in the Impersonation Protection Microsoft quarantine table. Clicking to release such an email from Impersonation Protection will correctly update to show it as Email released.
A released email will remain in the Microsoft 365 quarantine table and in the Impersonation Protection Microsoft quarantine table for the full 14-30 days.
Taking action on multiple emails
To release or delete multiple emails at once, select the checkboxes to the left of the emails you want to manage.
To select all available emails on the current page, click the Select all on page checkbox. Emails that have already been processed or are still being processed cannot be selected.
After making your selections, click the Delete or Release button at the top of the table. The selected action will apply to all eligible emails on the current page.
Note: You can select emails across multiple pages, but actions can be applied to only one page at a time.