Quarantined email because it contains a blocked file type - Unable to release?

Peter 100

We added the file type .zip to the list of blocked file types in the anti malware policy.

Now one user needs an email that has been quarantined because it contains a .zip file.
I tried to release the email.
It shows "Released" in the Release Status and I see the mail in the message trace, but it was again quarantined.

Is that an expected behavior? Means it's not possible to release emails that are quarantined because they contain a blocked file type?

Regards
Peter

Bruce Jing-MSFT 1,075 Reputation points Microsoft Vendor

2024-05-02T08:59:26.94+00:00
Hi，

Thanks for posting your question in the Microsoft Q&A forum.

Based on your description, I create the relevant policy to test it as the following steps:

1.I created an anti-malware policy and a custom quarantine policy.

2.Send the email with the .zip and then release it in Microsoft Defender.

3.Quarantined emails can be released normally and user can receive an email.

I have a few questions need to confirm with you.

How did you create your Anti-malware policy, can you provide the screenshots?

Is your quarantine policy default or customized?

Do other emails with zip attachments have the same problem? Or do other quarantined emails have this issue?
Peter 100 Reputation points

2024-05-03T14:32:55.7133333+00:00

Hi Bruce

It's custom policy.
Yes this issue exists with all zip attachements and also with other emails that contains attachments of any blocked file type.
Bruce Jing-MSFT 1,075 Reputation points Microsoft Vendor

2024-05-07T08:42:58.82+00:00
Hi，

I'm glad to hear from you.

I compared my policy with yours and found two differences.

1.You turned on Zero-hour auto purge (ZAP).I have test my policy with turning on Zero-hour auto purge, but it didn’t change the result.

2.You have a lot of custom file types. I suggest you create an anti-spam policy like mine which only contain .zip and select one or two users as Included users.

If the problem persists, please help collect the results of the cmdlets below:

Get-QuarantinePolicy | fl

Get-MalwareFilterPolicy |fl

Get-MalwareFilterRule |fl
Bruce Jing-MSFT 1,075 Reputation points Microsoft Vendor

2024-05-14T05:47:28.42+00:00

Hello, it's been a long time since I've heard from you, did my previous reply help you, if it was useful, you can mark it as an answer. Thank you for your understanding and support.

Share via

Quarantined email because it contains a blocked file type - Unable to release?