[EOP] Adding "Tag" to subjectline when message is released from quarantine

Question

Hello there, I'm trying to add a tag to the subject line of emails that are released from Exchange Online Quarantine anyway "[Quarantine] old subject...". What I have found out and tried so far: An email released from quarantine gets the value "SFV:SKQ" in the 'X-Forefront-Antispam-Report' header. I have tried to find this with a transport rule and adjust the subject line accordingly. However, a transport rule doesn't seem to trigger on emails that were already in quarantine, or I did it wrong. Is this even possible? Alternatively, it would be ok if the mails already get the tag when they enter the quarantine. Thank you

Answer 1

Hi @DM-5249，

However, a transport rule doesn't seem to trigger on emails that were already in quarantine, or I did it wrong. Is this even possible?

I am afraid it's not possible. Transport rules are applied before emails are put into quarantine (see image below), so per my understanding, it's an expected behavior that the transport rule you created doesn't trigger.
Reference: How EOP works.

As for your idea that adding the "tag" when emails enter the quarantine, it's not feasible either as an email could be quarantined for various reasons.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

You can create a Power Automate flow that will scans all user mailboxes and tag the messages that have "SFV:SKQ" in the 'X-Forefront-Antispam-Report' header.

The main disadvantage is the tag will appear in several minutes after released message delivering.