Admin not seeing all mail in Exchange Online Quarantine

Question

In our Exchange quarantine I can see all of the quarantined messages as a global admin, a co-worker with security admin role sees most of the quarantine (he sees phish, spam, malware) but he only sees the malware ones that are from the Anti-malware policy, he does not see the ones tagged as malware by the safe-attachments policy. What role or group does he need to be in to see these?

Answer 1

I would add the account to the Quarantine Admin role as well and test that. They have made some changes recently around these perms

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/quarantine-admin-manage-messages-files?view=o365-worldwide

Answer 2

I don't see a quarantine admin role in either Exchange Admin Center portal nor in Azure AD portal.

Answer 3

Hi @Rod MacPherson ,
The Quarantine Administrator role group in Email & collaboration roles in the Microsoft 365 Defender portal ,you could reach this link directly: Permissions - Microsoft 365 security
In addition ,you also need to be members of the Hygiene Management role group in Exchange Online to do quarantine procedures in Exchange Online PowerShell.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.