Find and release quarantined messages as an end user - Broward College

Note: If a malicious email is not quarantined and reaches the user's inbox then escalate a case and assign to Information Security group.

Exchange Online

This topic describes how you can find and release messages that were intended for you but were sent to the spam quarantine instead. It also explains how you can report false positive (not junk) messages to the Microsoft Spam Analysis Team, who will evaluate and analyze the message. Depending on the results of the analysis, the service-wide spam content filter rules may be adjusted to allow the message through.

Note:
Messages that match a transport rule can’t be sent to the end user spam quarantine. However, these messages can be retrieved by your administrator.

To access your spam-quarantined messages in the spam quarantine

1. Go to the following URL in a web browser: https://admin.protection.outlook.com/quarantine

2. On the sign in page, specify your valid Broward College email address and password.

   After you’ve signed in and been authenticated, you’ll be directed to the end user spam quarantine.

By default, spam-quarantined messages are sorted from newest to oldest on the RECEIVED field. SENDER, SUBJECT, and EXPIRES values are also listed for each message. You can sort on any of these fields by clicking their headers. Clicking a column header a second time will reverse the sort order. A maximum of 500 messages can be displayed spam quarantine.

You can view a list of all your spam-quarantined messages, or you can search for specific messages by specifying filter criteria (filtering can also help you reduce your result set if you have more than 500 messages). After searching for and locating a specific quarantined message, you can view details about the message. You can also release the message and report it as not junk to the Microsoft Spam Analysis Team.

Use advanced search to filter and locate quarantined messages

You can filter your own spam-quarantined items based on several different conditions using advanced search. You can use these conditions separately or in combination with one another. The search will provide a list of messages that meet all your filter criteria.

1. Click Advanced search  to open the Advanced search window.

   

2. Select any combination of the following conditions. Select the associated check box in order to enable each condition. Wildcards aren’t supported.

   1. Sender email address   Specify the email address of the person who sent the message.

   2. Subject  Specify the subject line text of the message.

   3. Received   You can select that the message was received by the quarantine within the past 24 hours (Today), within the past 48 hours (Last 2 days), within the past week (Last 7 days), or you can select a custom time interval during which the message was received by the quarantine.

   4. Expires   You can select that the message will be deleted from the quarantine within the next 24 hours (Today), within the next 48 hours (Next 2 days), within the next week (Next 7 days), or you can select a custom time interval during which the message will be deleted from the quarantine.

      Note: The length of time that messages are stored in the quarantine is controlled by your administrator.

3. Click ok to start running the advanced search.

   Note:
   To clear your search criteria and view all messages in the quarantine, clear all the check boxes in the Advanced search window, and then click ok.

After searching for messages, the results that match your specified criteria will display in the user interface. A maximum of 500 messages can be displayed in the spam quarantine.

View details about a specific quarantined message

After locating a specific quarantined message, you can view details about it.

1. In the spam quarantine, select a specific message and a summary of the properties of that message appear in the details pane on the right side of the screen.

   

   The message status values are as follows:

   • Type   This is always Spam.

   • Expires   The date when the message will be deleted from the quarantine.

   The message details values are as follows:

   • Sender   The email address of the person who sent the message.

   • Subject   The subject line text of the message.

   • Received   The date on which the message was received by the quarantine.

   • Size   The size of the message, in kilobytes (KB), or, if the message size is greater than 999 KBs, in megabytes (MB).

   • View message header   Click this link to open the message header dialog box, which lets you view the message header text. You can also copy the message header text to your clipboard and paste it into the Message Header Analyzer. Once in the Message Header Analyzer tool, click Analyze headers in order to retrieve information about the header.

     Tip:
     For information about specific anti-spam message header fields inserted by the service, see Anti-spam message headers.

Release a spam-quarantined message and optionally report it as not junk

After finding a spam-quarantined message, you can release the message to your inbox. When a message is released to your inbox, the service re-scans the released message for malware but skips spam filtering.

You can also optionally report the message as ‘not junk’ (also known as a false positive message) to the Microsoft Spam Analysis team, who will evaluate and analyze the message. Depending on the results of the analysis, the service-wide spam content filter rules may be adjusted to allow the message through.

To release a spam-quarantined message to your inbox and optionally report it as not junk

1. Select a message, click the Release Message  icon, and then from the list, click one of the following options:

   • Release message will simply release the message to your inbox.

     

   • Release message and report as not junk will release the message to your inbox and report it as not junk to the Microsoft Spam Analysis Team.

     

2. Click ok to confirm your decision and return to the main screen.

If you click the Refresh  icon to refresh your data, and then double-click the message, you should see that it’s been released to your inbox.