Emails Quarantined by Microsoft
The Microsoft quarantine page shows emails identified and quarantined by Microsoft 365 over the last 14-30 days, depending on how Microsoft 365 is configured.
An empty Microsoft quarantine table can occur if either of these are true:
Permissions for the latest Impersonation Protection features have not been granted. If a pink banner is visible at the top of any Impersonation Protection page, click Accept permissions and follow the steps to allow Impersonation Protection to access Microsoft 365 quarantine information.
Impersonation Protection onboarding recently completed or permissions were recently granted. Please check back in a short while. Impersonation Protection is in the process of gathering quarantine data from Microsoft 365.
Each row contains an email quarantined for an individual recipient. Therefore, an email sent to multiple recipients will show up in this table as multiple rows.
Example: An email is sent to Ted, Dana, and Bob. Based on Microsoft 365 settings, it is quarantined for Dana and Bob. It will show up in this table in two rows - once for Dana and once for Bob.
Table columns are as follows:
Date – The date and time the message was quarantined by Microsoft 365. The table can be sorted from newest to oldest or oldest to newest by clicking the Date column header.
Employee – This is the intended recipient of the email.
Email – This column shows the email sender and the subject.
MSFT Determination – The threat type as determined by Microsoft (Malware, Spam, etc.)
The last column shows actions that either were taken or can be taken with an email. An action can be to either view an emails details
or release an email
.
Syncing table data
Microsoft quarantine data is updated every three hours.
If they do release or delete in ms it may not show in our table until up to 24 hours. hopefully 3
Last sync shows the last time the Microsoft Quarantine table pulled in fresh table data.
Click the Refresh button to bypass the usual update time and immediately draw the latest Microsoft quarantined messages. Note: the refresh can take up to three minutes.
Finding specific emails
Search – Enter all or part of an email subject or sender address to find matching emails. The matching text will be highlighted.
Email details
Click the details icon
Releasing emails
Releasing an email removes it from Microsoft 365 quarantine and sends it on its way towards the message recipient. Barracuda Networks will then apply its own AI powered scanning and analysis of the email and determine if it is suitable for delivery.
Click the arrow icon
Email Released is then shown for that email.
Released messages remain in the Microsoft quarantine table for the same duration as they do in Microsoft 365’s quarantine (14-30 days).
Messages are released for one recipient at a time. Each row in the table shows an email for a single recipient. Clicking the arrow icon will release the email for only that recipient.
If an error occurs during the release process, Email not released will display.
One reason an error may occur is if the email was already deleted from Microsoft 365. See below for more information.
Emails deleted from within Microsoft 365
An email that has been deleted from the Microsoft 365 interface can still be displayed in the Impersonation Protection Microsoft quarantine table for up to 24 hours. Clicking to release such an email will result in an error and Email not released will be displayed.
Emails released from within Microsoft 365
An email that has been released from the Microsoft 365 interface can take up to 24 hours to show as released in the Impersonation Protection Microsoft quarantine table. Clicking to release such an email from Impersonation Protection will correctly update to show it as Email released.
A released email is not removed early from the Microsoft 365 quarantine table nor from the Impersonation Protection Microsoft quarantine table.