Office 365 / Email Quarantine
What is it quarantine?
Both users and admins can work with quarantined messages:
Quarantine policies define what users are allowed to do or not do to quarantined messages based on why the message was quarantined (for supported features). Default quarantine policies enforce the historical capabilities as described below. Admins can create and apply custom quarantine policies that define less restrictive or more restrictive capabilities for users, and also turn on quarantine notifications.
How long quarantined messages are held in quarantine before they expire varies based on why the message was quarantined. The features that quarantine messages and their corresponding retention periods are described in the following table:
Quarantine reason Default retention period Customizable? Comments Messages quarantined by anti-spam policies: spam, high confidence spam, phishing, high confidence phishing, or bulk. 15 days: - In the default anti-spam policy.
- In anti-spam policies that you create in PowerShell.
30 days in anti-spam policies that you create in the Microsoft 365 Defender portal.
Yes You can configure (lower) this value in anti-spam policies. For more information, see the Retain spam in quarantine for this many days (QuarantineRetentionPeriod) setting in Configure anti-spam policies. Messages quarantined by anti-phishing policies: spoof intelligence in EOP; user impersonation, domain impersonation, or mailbox intelligence in Defender for Office 365. 30 days Yes This retention period is also controlled by the Retain spam in quarantine for this many days (QuarantineRetentionPeriod) setting in anti-spam policies. The retention period that's used is the value from the first matching anti-spam policy that the recipient is defined in. Messages quarantined by anti-malware policies (malware messages). 15 days No Messages quarantined by Safe Attachments policies in Defender for Office 365 (malware messages). 15 days No Messages quarantined by mail flow rules: the action is Deliver the message to the hosted quarantine (Quarantine). 30 days No Files quarantined by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams (malware files). 15 days No When a message expires from quarantine, you can't recover it.