This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 41%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
I have noticed this new antispam quarantine option in Action.
Just to double check the defaultfullaccesspolicy option means the user:
1) will be notified that an email has been blocked and present in quarantine (will the frequency be immediate or one per day???)
2) can access the quarantine to look at the email filtered.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 67%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
Hi @Marc
Any update here, do suggestions below help?
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi Andy - I've been investigating how the preset (standard and strict) policies in Defender for Office 365 are configured and think they'd be absolutely fine for my organisation. The bit I'm struggling with though is the notifications - you certainly sound like you know your stuff in this area so I'm really hoping you can help.
If I've understood it correctly, it's not possible to enable notifications when using the preset policies as you can't enable notifications in the 'DefaultFullAccessPolicy' quarantine policy, and you can't configure the preset policies to use a different quarantine policy. I'm really hoping I'm wrong here as not being able to notify users of quarantined messages when using Microsoft's recommended setup seems bonkers!
Thanks, Oz
The default policy means no notifications and the user has full access:
You can create custom policies as well of course
How can I enable "Notification Enabled policy" and/or create a "custom policies "?
In that case can I also choose the frequency of the notifications?
Thanks
To create a custom policy simply follow these steps and enable notifications:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/quarantine-policies?view=o365-worldwide#step-1-create-quarantine-policies-in-the-microsoft-365-defender-portal
You may not have the built-in default notification policy in your tenant:
I have created a Custom Policy and enabled it on the antispam policy .... but.... I couldn't find it on Phishing and Malware options.
You can set for phishing here:
https://security.microsoft.com/antiphishing
anti-malware doesnt apply for these policies
I couldn't see Notification... and my customPolocy in anti-phishing
Sorry, misunderstood you. The notifications you set in the anti-spam policy apply to messages deemed as phish in the anti-spam policy, not the anti-phishing specific policy itself. Hope that makes sense.
So , in other words, if you have these set, they will apply to any message that is in the quarantine - except messages blocked by a transport rule or malware
Hi Andy,
checking today in anti-phishing and anti-malware I found the custom quarantine policy I have crated.
Very strange, I have refreshed several times and re-logged. Maybe it takes more time to be applied there.
Cool! Patience is always a virtue with Azure :)