How to navigate and managed Office 365 Spam Filter

What do you need to know before you begin?

• To open the Microsoft 365 Defender portal, go to https://security.microsoft.com. To go directly to the Quarantine page, use https://security.microsoft.com/quarantine.
• Admins can configure how long messages are kept in quarantine before they’re permanently deleted in anti-spam policies. Messages that have expired from quarantine are unrecoverable. For more information, see Configure anti-spam policies in EOP.
• By default, messages that were quarantined for high confidence phishing, malware, or by mail flow rules are only available to admins, and aren’t visible to users. For more information, see Manage quarantined messages and files as an admin in EOP.

---

1. In the Microsoft 365 Defender portal at https://security.microsoft.com, go to Email & collaboration > Review > Quarantine. To go directly to the Quarantine page, use https://security.microsoft.com/quarantine.
2. On the Quarantine page, you can sort the results by clicking on an available column header. Click Customize columns to change the columns that are shown. The default values are marked with an asterisk (^*):
   • Time received^*
   • Subject^*
   • Sender^*
   • Quarantine reason^*
   • Release status^*
   • Policy type^*
   • Expires^*
   • Recipient
   • Message ID
   • Policy name
   • Message size
   • Mail direction
   When you’re finished, click Apply.
   • To filter the results, click Filter. The following filters are available in the Filters flyout that appears:
     • Message ID: The globally unique identifier of the message.Sender addressRecipient addressSubjectTime received: Enter a Start time and End time (date).Expires: Filter messages by when they will expire from quarantine:
       • TodayNext 2 daysNext 7 daysCustom: Enter a Start time and End time (date).
       Quarantine reason:
       • BulkSpamPhishing: The spam filter verdict was Phishing or anti-phishing protection quarantined the message (spoof settings or impersonation protection).High confidence phishing
       Release status: Any of the following values:
       • Needs reviewApprovedDeniedRelease requestedReleased
       Policy Type: Filter messages by policy type:
       • Anti-malware policySafe Attachments policyAnti-phishing policyAnti-spam policy
     When you’re finished, click Apply. To clear the filters, click Clear filters.
3. Use Search box and a corresponding value to find specific messages. Wildcards aren’t supported. You can search by the following values:
   • Message ID
   • Sender email address
   • Recipient email address
   • Subject. Use the entire subject of the message. The search is not case-sensitive.
   • Policy name. Use the entire policy name. The search is not case-sensitive.
   After you’ve entered the search criteria, press the ENTER key to filter the results. NoteThe Search box on the main Quarantine page will search only quarantined items in the current view, not the entire quarantine. To search all quarantined items, use Filter and the resulting Filters flyout.

After you find a specific quarantined message, select the message to view details about it, and to take action on it (for example, view, release, download, or delete the message).