MS365 Email Quarantine - email redirection

Question

Hello, we´re currently facing an issue with MS365 Quarantine and with the "High Confidence Phish" (=HCP) emails respectively. Since MS has disabled all possible workarounds, how to prevent certain senders and domains being marked as HCP and thus ALWAYS sent into quarantine, it seems that the only remaining option is to disable the quarantine completely.

It would be all right if the usres would get the daily quarantine reports including the "HCP" emails but they aren´t there at all and we as admins don´t have mailbox licenses in this particular tenant (just to save costs for the customer...) so there´s no way to set admin quarantine notifications either.

Basically, some emails from certain trustworthy domain have been falsely marked as "HCP" and even though it´s very rare, the customer got a "little bit concerned" about it and would like to have the quarantine disabled completely, not willing to miss any important emails. (Murphy´s laws...) And we can´t even guarantee them that this particualr domain / senders will be whitelisted forever because the whitelist cannot be set for longer than 30 days (I did report the false-positive email to MS as well).

Of course we realize the quarantine brings more good than harm, in general, and is right most of the times but to my question:

1. If we disable the quarantine - that is, if the command below is correct and won´t bring any unexpected results or implications - we don´t want to disable the entire security policy of course...

   Set-HostedContentFilterPolicy -Identity "Default" -QuarantineStatus $false

1. Will the High Phish, Phish, SPAM emails (that would normally end up in quarantine) be delivered into the main user inboxes or the SPAM folder?
   1. The sources I´ve seen so far seem to be rather uneven - some claim that the emails will be delivered right to the inbox but if ONLY the quarantine would be disabled, shouldn´t the security policy still remain active, and thus the headers of incoming emails should still be marked as SPAM? (by adding the SCL attribute for example)
   2. Or is it just wishful thinking from my side and all of the above would be ignored and the emails will eventually end up in the inboxes. Thank you Jakub

Answer 1

Hi @Jakub ,

Set-HostedContentFilterPolicy -Identity "Default" -QuarantineStatus $false

This command is incorrect and it is not feasible to disable the quarantine feature in office 365. If messages are always sent to quarantine as HCP, you can try creating a mail flow rule that sets the SCL of a message, with "message marked as spam" as the medium confidence spam action (5-6). For reference: Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.