Introduction

Click the play button to view the GIF on Quarantined emails.

Quarantined emails are messages that are flagged as suspicious or potentially harmful—such as spam, phishing attempts, or policy violations—by your organization's email security system. 

Instead of being delivered directly to the recipient’s inbox, these messages are held in a quarantine area for further review.

Both Microsoft 365 and Google Workspace provide centralized quarantine tools for administrators to view, release, or block these emails before they reach users. This helps protect your organization’s data and ensures that legitimate communication isn’t lost due to aggressive filtering.

Access the quarantine dashboards in Microsoft Defender and Google Admin Console.

In this article, you will learn about:

• Accessing the quarantine dashboards in Microsoft Defender and Google Admin Console
• Reviewing message details and reasons for quarantine
• Allowing or denying email delivery
• Searching and filtering quarantined messages
• Retention policies and message handling behaviors

Accessing and Managing Quarantine Emails in Microsoft

Follow these steps to access and manage Quarantine emails:

1. Go to https://office.com.
2. Log in with your Microsoft 365 account.
3. Click the App Launcher in the top-left corner.
4. Select Security.
5. In Microsoft 365 Defender, navigate to Email & Collaboration> Review > Quarantine. You'll see a list of quarantined messages.
   1. Use filters to narrow down the messages (e.g., spam, phishing).
6. Select a message to open the preview panel on the right.
7. Click the More actions to see available actions:
   1. Allow Sender – Adds the sender to your allowed list (optional, for future messages).
   2. Release – Sends the email to your inbox.
   3. Report – Submits the message to Microsoft for analysis.
8. Click Send to release the message.
9. Click Done, then close the panel.

Note: 

You can automate the above process or receive quarantine emails to your inbox, review them, and then allow or reject them based on the necessity of the email type. If you need additional support:

• The Allow Sender and Submit to Microsoft options may not appear if the administrator has restricted those permissions.
• This process is applicable for end users; admins can manage quarantined emails differently via the Exchange Admin Center.
• Contact the Microsoft technical support team for assistance with automating this process. To learn more about the setup, click here.

Accessing and Managing Quarantine Emails in Google Workspace

Google Workspace allows administrators to quarantine certain incoming or outgoing emails for review before they're delivered to recipients. This is useful for handling spam, phishing, or policy-violating messages.

Note:

• Only users with appropriate admin privileges can access and manage quarantined emails. 
• If you're not a super admin, your access may be limited based on roles and group memberships.

Follow the steps below to access the quarantine dashboard:

1. Sign in to admin.google.com using a super administrator account.
2. Go to Apps > Google Workspace > Gmail > Manage quarantines.
3. Click Go to Quarantine.

Review Quarantined Emails

When you log into email quarantine, the default view is all messages in all quarantines with a status of Pending triage.

To get details about which quarantine a message belongs to, point at the message in the dashboard. The Quarantine details box opens, and it shows the quarantine name and the settings that you created for the quarantine.

Filter quarantined messages

Using the controls at the top of the dashboard, you can filter messages by quarantine or by message status.

• To show messages from one quarantine, click Quarantine, select a quarantine from the list, and click Apply.
• To show all messages from all quarantines, click Quarantine, select All, and click Apply.
• To filter messages by quarantine status, click Status, select a status, and click Apply.

Search for quarantined messages

To find messages by searching on message content, at the top of the dashboard, enter search terms in the Search field. 

Only messages that match the current dashboard filters (Quarantine name and message status) are searched.

All message content is searched, including header information such as sender address, recipient email address, message subject, and message body.

To create more targeted searches, use the same search operators used in Gmail.

View email message headers

Headers are short code snippets that are sent along with an email message and contain information about the message. 

Some headers, such as From: and Subject:, are typically visible in a message. 

Other headers are only visible when you view full headers for the message. To view the complete content of a quarantined email message, including all email headers:

• In the quarantine dashboard, click the menu to the left of the Name column. The dashboard entry expands to show the message.
• Click Show Original at the bottom right of the expanded entry,

Taking Action on Quarantined Messages in Google Workspace

Once a message is quarantined, admins can choose to either allow or deny its delivery. Please note that once an action is taken, it cannot be undone.

Allowing Delivery of Quarantined Messages

To release a message from quarantine and deliver it to the recipient:

1. Go to the Quarantine Dashboard.
2. Select one or more messages by checking the box next to them.
3. Click Allow at the top of the dashboard.

The message will be delivered to the user. If it doesn't appear in their inbox, advise them to check their Spam folder.

Denying Delivery of Quarantined Messages

To block a message from being delivered:

1. In the Quarantine Dashboard, select the message(s) by checking the boxes.
2. Click Deny.

Depending on the Denial consequence setting configured for the quarantine, the system may automatically send a rejection notice to the original sender.

Denied messages remain in quarantine for 30 days, after which they are permanently deleted and cannot be recovered, even by admins.

Note: If your organization uses additional storage solutions such as Google Vault, quarantined messages may still be retained there based on your configured retention policies.

Denying Messages in Multiple Quarantines

Sometimes a message may appear in multiple quarantines. When you deny delivery, the action is governed by the settings of the specific quarantine where the action is taken.

Example:
A message appears in two quarantines:

• Suspicious: Denial consequence: Drop message
• Large Attachment: Denial consequence: Send rejection notice

If you deny the message from the Suspicious quarantine, the message will be dropped without sending a rejection notice. To learn more about managing quarantine emails in Google workspace, click here.



​​​​​​​