After MC1171845 (quarantine listed per recipient) — how many quarantine records can one Internet Message ID produce, and is RecipientAddress populated in summary results?

Question

We automate release of quarantined messages by Internet Message ID using the ExchangeOnlineManagement module with certificate-based app-only authentication.

Following MC1171845 ("Microsoft Defender for Office 365: Enhancing the quarantine experience for administrators", GA January–March 2026), which states that quarantined messages are now listed by individual recipient and that "ReleaseToAll now applies to a single user as aggregation has been removed", For . 2 behaviors we can't find documented:

1. Does quarantine create one record per expanded distribution group member?
   1. For a message sent to a 5-member distribution group, which is expected?
      • A — 5 rows, one per member: {******@contoso.com}, {******@contoso.com}, …
      • B — 1 row for the group: {******@contoso.com}
2. Recommended approach above 1,000 records -PageSize caps at 1000. Is looping -Page the supported pattern?

      $p = 1
      do {
          $b = @(Get-QuarantineMessage -MessageId "<******@contoso.com>" -PageSize 1000 -Page $p++)
          $all += $b
      } while ($b.Count -eq 1000)
   

   Or is there a better bulk/asynchronous path for very large recipient counts?

Answer 1

Dear @Ashay Patel, 

I hope you’re having a good day. 

Thank you for the detailed and well-structured questions.

Based on MC1171845, Microsoft has confirmed that quarantine items are now represented and managed at the individual recipient level rather than as aggregated multi-recipient entries. Microsoft also states that ReleaseToAll now applies to a single user because recipient aggregation has been removed, and administrators must perform release actions at the recipient level.

From the currently available documentation, the following points are clearly established:

• Quarantined messages are presented on a per-recipient basis. 
• Existing quarantine PowerShell cmdlets remain supported after the change. 
• Release operations should be designed around recipient-level processing rather than the previous aggregated model.

Your questions regarding:

• Distribution Group expansion behavior,
• the number of quarantine objects that may be produced by a single Internet Message ID,
• population of RecipientAddress in the returned results,
• and the recommended retrieval strategy when the result set exceeds 1,000 entries,

are implementation-specific details that are not currently described in the public documentation I was able to review. The available documentation explains the architectural change to recipient-level quarantine management, but does not define those backend behaviors in detail.  Because your automation relies on these behaviors for message release at scale, I would recommend opening a Microsoft support case to obtain authoritative guidance from the Exchange Online / Microsoft Defender engineering teams.

You can raise support ticket from Microsoft 365 Admin Center>Support>Help & Support.  

For reference:  Get support | Microsoft Docs   

Include:

1. • The Message Center reference is MC1171845.
   • Sample Internet Message ID values.
   • Your current automation approach.
   • Expected versus observed quarantine results.
   • Questions regarding the Distribution Group expansion, RecipientAddress, and paging behavior.

Providing those details upfront will help the support engineer engage the appropriate backend team more quickly and determine whether there is documented guidance, expected behavior, or implementation considerations that are not yet reflected in public documentation.

Your use case is a good example of where recipient-level quarantine changes can affect existing automation workflows, and clarification from Microsoft would likely benefit other administrators implementing similar release processes after MC1171845. 

Thank you for raising these questions and for providing a clear example of the scenarios involved. I hope this helps point you toward the most effective path for obtaining definitive guidance on the updated quarantine behavior.

Warm regards,  

---

If the answer is helpful, please select "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in the forum documentation to enable email notifications if you want to receive the related email notification for this thread.