Use user spam notifications to release and report quarantined messages

Important

Welcome to Microsoft Defender for Office 365, the new name for Office 365 Advanced Threat Protection. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.

In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, quarantine holds potentially dangerous or unwanted messages. For more information, see Quarantined messages in EOP.

By default, end-user spam notifications are disabled in anti-spam policies. When an admin enables end-user spam notifications, recipients (including shared mailboxes with automapping enabled) will receive periodic notifications about their messages that were quarantined as spam, bulk email, or (as of April 2020) phishing.

For shared mailboxes, end-user spam notifications are only supported for users who are granted FullAccess permission to the shared mailbox. For more information, see Use the EAC to edit shared mailbox delegation.

End User Spam notification is not supported for groups.

Note

Messages that were quarantined as high confidence phishing, malware, or by mail flow rules (also known as transport rules) are only available to admins. For more information, see Manage quarantined messages and files as an admin in EOP.

An end-user spam notification contains the following information for each quarantined message:

  • Sender: The send name and email address of the quarantined message.

  • Subject: The subject line text of the quarantined message.

  • Date: The date and time (in UTC) that the message was quarantined.

  • Block Sender: Click this link to add the sender to your Blocked Senders list. For more information, see Block a mail sender.

  • Release: For spam (not phishing) messages, you can release the message here without going to Quarantine the Security & Compliance Center.

  • Review: Click this link to go to Quarantine in the Security & Compliance Center, where you can (depending on why the message was quarantined) view, release, delete or report your quarantined messages. For more information, see Find and release quarantined messages as a user in EOP.

Example end-user spam notification

Note

A blocked sender can still send you mail. Any messages from this sender that make it to your mailbox will be immediately moved to the Junk Email folder. Future messages from this sender will go to your Junk Email folder or to the end-user quarantine. If you would like to delete these messages on arrival instead of quarantining them, use mail flow Rules (also known as transport rules) to delete the messages on arrival.