Hi everyone, I’m having trouble with Microsoft Defender for Office 365, specifically related to releasing a secure email from quarantine. The email has been identified as safe, but it's still being blocked. Here are the steps I’ve already taken to resolve the issue: Reviewed the Quarantine Section : I accessed the quarantine section in the Microsoft 365 Defender portal and attempted to release the email manually. Added the Sender to the Allow List : I added the sender’s domain and email address to the Safe Senders list in the Anti-Spam policy. Checked the Policies : I verified that the email met all criteria in the Email & Collaboration policies for not being quarantined. Adjusted Filters : I adjusted some filters in the Anti-Phishing policy to be more lenient regarding this specific sender and secure emails. Double-Checked Rules : Ensured that no custom rules or transport rules were set up that might be affecting this sender’s emails. Despite taking these steps, the email continues to be quarantined, and I'm unsure what else could be causing the issue. Could anyone provide insight into what I might be missing or suggest any additional steps I can take to allow this email to pass through without being blocked in the future? Thank you so much for your help!

Hello @Larry Shockey You can add the sender's address to the safe senders list to prevent future issues. Step 1: Access Microsoft Defender Portal Log in to the Microsoft 365 Defender portal using your administrator credentials. This is where you can manage security settings and view quarantined emails. Step 2: Navigate to Quarantine Once logged in, go to the "Email & collaboration" section. From there, select "Quarantine" to view all emails that have been flagged and quarantined. Step 3: Locate the Email In the quarantine list, search for the specific email you want to release. You can use filters or search options to find it quickly, such as by sender, subject, or date. Step 4: Review Email Details Click on the email to view its details. Ensure that it has been marked as safe and check the reason for its quarantine. This will help confirm that it is indeed safe to release. Step 5: Release the Email If you confirm the email is safe, select the option to "Release message." This will typically prompt you to confirm the action. Make sure to select any additional options, such as notifying the recipient. Step 6: Adjust Policies (if necessary) If the email continues to be blocked after release, you may need to adjust your organization's policies. Go to the "Policies" section and review settings related to spam filtering or safe senders. You can add the sender's address to the safe senders list to prevent future issues. If the Answer is helpful, please click Accept Answer and Up-Vote , so that it can help others in the community looking for help on similar topics.

Hi，@ Larry Shockey It's nice to hear back from you. Great to know that the issue has already been resolved and thanks for sharing the solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that " The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to " Accept " the answer : ) -------------- Issue Symptom: Release a secure email from quarantine that has been determined to be secure but is still blocked. Here's what has been tried, but the problem still hasn't been fixed. Reviewed the Quarantine Section Added the Sender to the Allow List Checked the Policies Adjusted Filters Double-Checked Rules Resolution: Add Domain to Safe Domains List in Exchange Admin Center (EAC)

Help with Microsoft Defender Quarantine - Allowing Secure Emails After Review

Larry Shockey 20

Hi everyone, I’m having trouble with Microsoft Defender for Office 365, specifically related to releasing a secure email from quarantine. The email has been identified as safe, but it's still being blocked. Here are the steps I’ve already taken to resolve the issue:

Reviewed the Quarantine Section: I accessed the quarantine section in the Microsoft 365 Defender portal and attempted to release the email manually.
Added the Sender to the Allow List: I added the sender’s domain and email address to the Safe Senders list in the Anti-Spam policy.
Checked the Policies: I verified that the email met all criteria in the Email & Collaboration policies for not being quarantined.
Adjusted Filters: I adjusted some filters in the Anti-Phishing policy to be more lenient regarding this specific sender and secure emails.
Double-Checked Rules: Ensured that no custom rules or transport rules were set up that might be affecting this sender’s emails.

Despite taking these steps, the email continues to be quarantined, and I'm unsure what else could be causing the issue. Could anyone provide insight into what I might be missing or suggest any additional steps I can take to allow this email to pass through without being blocked in the future?

Thank you so much for your help!

SUNOJ KUMAR YELURU 14,466 Reputation points MVP

2024-10-06T07:18:36.7466667+00:00

@Larry Shockey

To follow-up, Please let us know if you have further query on this and don’t forget to Accept the answer
Bruce Jing-MSFT 5,870 Reputation points Microsoft Vendor

2024-10-07T05:22:21.5366667+00:00

Hi, @ @Larry Shockey

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Bruce Jing-MSFT 5,870 Reputation points Microsoft Vendor

2024-10-17T06:54:43.02+00:00

Hello, @@Larry Shockey

It's been a long time since I've heard from you, have you solved your problem yet? Did my previous reply help you？ If it was useful, you can mark it as an answer. Thank you for your understanding and support.

Accepted answer

SUNOJ KUMAR YELURU 14,466 Reputation points MVP

2024-10-05T02:11:51.69+00:00

Hello @Larry Shockey

You can add the sender's address to the safe senders list to prevent future issues.

Step 1: Access Microsoft Defender Portal

Log in to the Microsoft 365 Defender portal using your administrator credentials. This is where you can manage security settings and view quarantined emails.

Step 2: Navigate to Quarantine

Once logged in, go to the "Email & collaboration" section. From there, select "Quarantine" to view all emails that have been flagged and quarantined.

Step 3: Locate the Email

In the quarantine list, search for the specific email you want to release. You can use filters or search options to find it quickly, such as by sender, subject, or date.

Step 4: Review Email Details

Click on the email to view its details. Ensure that it has been marked as safe and check the reason for its quarantine. This will help confirm that it is indeed safe to release.

Step 5: Release the Email

If you confirm the email is safe, select the option to "Release message." This will typically prompt you to confirm the action. Make sure to select any additional options, such as notifying the recipient.

Step 6: Adjust Policies (if necessary)

If the email continues to be blocked after release, you may need to adjust your organization's policies. Go to the "Policies" section and review settings related to spam filtering or safe senders. You can add the sender's address to the safe senders list to prevent future issues.

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.
Please sign in to rate this answer.
Larry Shockey 20 Reputation points

2024-10-07T15:23:24.6066667+00:00

Yes I have done these steps but the email is still getting stuck in the quarantine zone. I have added the senders email and the domain to the safe list and even created Whitelist rules to allow the senders as well. The results are still the same.

Bruce Jing-MSFT 5,870 Reputation points Microsoft Vendor

2024-10-09T08:00:30.8933333+00:00

Hi，@Larry Shockey

In the Microsoft 365 Defender portal, check the Threat Protection Status report to see if there's any information on why the email was quarantined. Can you provide a screenshot of why the email was quarantined?

You can also use Message Trace to query why the email was quarantined.

Bruce Jing-MSFT 5,870 Reputation points Microsoft Vendor

2024-10-11T08:16:40.9733333+00:00

Hello, @Larry Shockey

It's been a long time since I've heard from you, have you solved your problem yet?

Larry Shockey 20 Reputation points

2024-10-11T14:00:03.2366667+00:00

@Bruce Jing-MSFT yes I did figure out where the issue was at and I did get it corrected. I am good to go now.

I recently faced a similar issue where emails from a trusted domain were continuously being quarantined in Microsoft Defender, even after marking them as false positives and whitelisting the sender.

After extensive troubleshooting, here’s the solution that worked for me:

Solution: Add Domain to Safe Domains List in Exchange Admin Center (EAC)

I resolved the issue by adding the domain in question (in my case, bcbsmt.com) to the Safe Domains list in the Exchange Admin Center. This allowed legitimate emails from the domain to bypass quarantine without any further issues.

Here’s a quick overview of how I did this:

Log into the Exchange Admin Center (EAC).

Go to Protection > Connection Filter.

Navigate to Safe Domains and add the trusted domain (e.g., bcbsmt.com).

Save the changes.

After this, emails from the domain started flowing through without being blocked or quarantined.

Important Consideration: IT Manager Approval

However, I realized that blindly adding domains to the Safe Domains list can introduce security risks. Therefore, I’ve implemented a new approval process:

IT Manager Approval Required: Only after thorough verification and IT Manager approval is a domain added to the Safe Domains list. This ensures that only trusted domains are whitelisted, reducing the risk of allowing potentially harmful emails through.

Key Steps I Followed:

Troubleshoot: Identified that the emails were being quarantined despite whitelisting attempts.

Investigated SPF, DKIM, and DMARC Records: Ensured the domain had proper authentication measures in place.

Added Domain to Safe Domains List (After IT Manager Approval): Allowed the legitimate sender through, but only after verifying their domain and getting management approval.

This approach helped resolve the issue while maintaining security.

Let me know if anyone else has experienced this, or if you have additional recommendations to improve this process!I recently faced a similar issue where emails from a trusted domain were continuously being quarantined in Microsoft Defender, even after marking them as false positives and whitelisting the sender.

After extensive troubleshooting, here’s the solution that worked for me:

Solution: Add Domain to Safe Domains List in Exchange Admin Center (EAC)

I resolved the issue by adding the domain in question (in my case, bcbsmt.com) to the Safe Domains list in the Exchange Admin Center. This allowed legitimate emails from the domain to bypass quarantine without any further issues.

Here’s a quick overview of how I did this:

Log into the Exchange Admin Center (EAC).

Go to Protection > Connection Filter.

Navigate to Safe Domains and add the trusted domain (e.g., bcbsmt.com).

Save the changes.

After this, emails from the domain started flowing through without being blocked or quarantined.

Important Consideration: IT Manager Approval

However, I realized that blindly adding domains to the Safe Domains list can introduce security risks. Therefore, I’ve implemented a new approval process:

IT Manager Approval Required: Only after thorough verification and IT Manager approval is a domain added to the Safe Domains list. This ensures that only trusted domains are whitelisted, reducing the risk of allowing potentially harmful emails through.

Key Steps I Followed:

Troubleshoot: Identified that the emails were being quarantined despite whitelisting attempts.

Investigated SPF, DKIM, and DMARC Records: Ensured the domain had proper authentication measures in place.

Added Domain to Safe Domains List (After IT Manager Approval): Allowed the legitimate sender through, but only after verifying their domain and getting management approval.

This approach helped resolve the issue while maintaining security.

Let me know if anyone else has experienced this, or if you have additional recommendations to improve this processyes I did figure out where the issue was at and I did get it corrected. I am good to go now.

I recently faced a similar issue where emails from a trusted domain were continuously being quarantined in Microsoft Defender, even after marking them as false positives and whitelisting the sender.

After extensive troubleshooting, here’s the solution that worked for me:

Solution: Add Domain to Safe Domains List in Exchange Admin Center (EAC)

I resolved the issue by adding the domain in question (in my case, bcbsmt.com) to the Safe Domains list in the Exchange Admin Center. This allowed legitimate emails from the domain to bypass quarantine without any further issues.

Here’s a quick overview of how I did this:

Log into the Exchange Admin Center (EAC).

Go to Protection > Connection Filter.

Navigate to Safe Domains and add the trusted domain (e.g., bcbsmt.com).

Save the changes.

After this, emails from the domain started flowing through without being blocked or quarantined.

Important Consideration: IT Manager Approval

However, I realized that blindly adding domains to the Safe Domains list can introduce security risks. Therefore, I’ve implemented a new approval process:

IT Manager Approval Required: Only after thorough verification and IT Manager approval is a domain added to the Safe Domains list. This ensures that only trusted domains are whitelisted, reducing the risk of allowing potentially harmful emails through.

Key Steps I Followed:

Troubleshoot: Identified that the emails were being quarantined despite whitelisting attempts.

Investigated SPF, DKIM, and DMARC Records: Ensured the domain had proper authentication measures in place.

Added Domain to Safe Domains List (After IT Manager Approval): Allowed the legitimate sender through, but only after verifying their domain and getting management approval.

This approach helped resolve the issue while maintaining security.

Let me know if anyone else has experienced this, or if you have additional recommendations to improve this process!I recently faced a similar issue where emails from a trusted domain were continuously being quarantined in Microsoft Defender, even after marking them as false positives and whitelisting the sender.

After extensive troubleshooting, here’s the solution that worked for me:

Solution: Add Domain to Safe Domains List in Exchange Admin Center (EAC)

I resolved the issue by adding the domain in question (in my case, bcbsmt.com) to the Safe Domains list in the Exchange Admin Center. This allowed legitimate emails from the domain to bypass quarantine without any further issues.

Here’s a quick overview of how I did this:

Log into the Exchange Admin Center (EAC).

Go to Protection > Connection Filter.

Navigate to Safe Domains and add the trusted domain (e.g., bcbsmt.com).

Save the changes.

After this, emails from the domain started flowing through without being blocked or quarantined.

Important Consideration: IT Manager Approval

However, I realized that blindly adding domains to the Safe Domains list can introduce security risks. Therefore, I’ve implemented a new approval process:

IT Manager Approval Required: Only after thorough verification and IT Manager approval is a domain added to the Safe Domains list. This ensures that only trusted domains are whitelisted, reducing the risk of allowing potentially harmful emails through.

Key Steps I Followed:

Troubleshoot: Identified that the emails were being quarantined despite whitelisting attempts.

Investigated SPF, DKIM, and DMARC Records: Ensured the domain had proper authentication measures in place.

Added Domain to Safe Domains List (After IT Manager Approval): Allowed the legitimate sender through, but only after verifying their domain and getting management approval.

This approach helped resolve the issue while maintaining security.

Let me know if anyone else has experienced this, or if you have additional recommendations to improve this process!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Bruce Jing-MSFT 5,870 Reputation points Microsoft Vendor

2024-10-14T01:36:16.5433333+00:00
Hi，@Larry Shockey

It's nice to hear back from you.

Great to know that the issue has already been resolved and thanks for sharing the solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to "Accept" the answer : )

--------------

Issue Symptom:

Release a secure email from quarantine that has been determined to be secure but is still blocked.

Here's what has been tried, but the problem still hasn't been fixed.

Reviewed the Quarantine Section

Added the Sender to the Allow List

Checked the Policies

Adjusted Filters

Double-Checked Rules

Resolution:

Add Domain to Safe Domains List in Exchange Admin Center (EAC)
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Help with Microsoft Defender Quarantine - Allowing Secure Emails After Review

1 additional answer

Your answer