[EOP] Adding "Tag" to subjectline when message is released from quarantine

DM-5249 21 Reputation points
2023-04-12T08:34:40.74+00:00

Hello there, I'm trying to add a tag to the subject line of emails that are released from Exchange Online Quarantine anyway "[Quarantine] old subject...". What I have found out and tried so far: An email released from quarantine gets the value "SFV:SKQ" in the 'X-Forefront-Antispam-Report' header. I have tried to find this with a transport rule and adjust the subject line accordingly. However, a transport rule doesn't seem to trigger on emails that were already in quarantine, or I did it wrong. Is this even possible? Alternatively, it would be ok if the mails already get the tag when they enter the quarantine. Thank you

Microsoft Exchange Online
Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,250 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Yuki Sun-MSFT 40,881 Reputation points
    2023-04-13T04:14:21.7833333+00:00

    Hi @DM-5249,

    However, a transport rule doesn't seem to trigger on emails that were already in quarantine, or I did it wrong. Is this even possible?

    I am afraid it's not possible. Transport rules are applied before emails are put into quarantine (see image below), so per my understanding, it's an expected behavior that the transport rule you created doesn't trigger.
    Reference: How EOP works.
    User's image

    As for your idea that adding the "tag" when emails enter the quarantine, it's not feasible either as an email could be quarantined for various reasons.


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


  2. Victor Ivanidze 101 Reputation points
    2023-05-02T08:57:10.3866667+00:00

    You can create a Power Automate flow that will scans all user mailboxes and tag the messages that have "SFV:SKQ" in the 'X-Forefront-Antispam-Report' header.

    The main disadvantage is the tag will appear in several minutes after released message delivering.

    0 comments No comments