Queues insight in the Security & Compliance Center
The improved Microsoft 365 security center is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. Learn what's new.
- Exchange Online Protection
- Microsoft Defender for Office 365 plan 1 and plan 2
- Microsoft 365 Defender
When messages can't be sent from your organization to your on-premises or partner email servers using connectors, the messages are queued in Microsoft 365. Common examples that cause this condition are:
- The connector is incorrectly configured.
- There have been networking or firewall changes in your on-premises environment.
Microsoft 365 will continue to retry to delivery for 24 hours. After 24 hours, the messages will expire and will be returned to the senders in non-delivery reports (also known as a NDRs or bounce messages).
If the queued email volume exceeds the pre-defined threshold (the default value is 200 messages), the information is available in the following locations:
Admins will receive an email notification based on the configuration of the default alert policy named Messages have been delayed. To configure the notification settings for this alert, see the next section.
For more information about alert policies, see Alert policies in the Security & Compliance Center.
Customize queue alerts
On the Alert policies page, find and select the policy named Messages have been delayed.
In the Message have been delayed flyout that opens, you can turn the alert on or off and configure the notification settings.
Status: You can toggle the alert on or off.
Email recipients and Daily notification limit: Click Edit to configure the following settings:
To configure the notification settings, click Edit. In the Edit policy flyout that appears, configure the following settings:
- Send email notifications: The default value is on.
- Email recipients: The default value is TenantAdmins.
- Daily notification limit: The default value is No limit.
- Threshold: The default value is 200.
When you're finished, click Save and Close.
Queues insight in the Mail flow dashboard
Even if the queued message volume hasn't exceeded the threshold and generated an alert, you can still use the Queues insight in the Mail flow dashboard to see messages that have been queued for more than one hour, and take action before the number of queued messages becomes too large.
If you click the number of messages on the widget, a Messages queued flyout appears with the following information:
- Number of queued messages
- Connector name: Click on the connector name to manage the connector in the Exchange admin center (EAC).
- Queue started time
- Oldest messages expired
- Destination server
- Last IP address
- Last error
- How to fix: Common issues and solutions are available. If a Fix it now link is available, click it to fix the problem. Otherwise, click on any available links for more information about the error and possible solutions.
The same flyout is displayed after you click View queue in the details of a Messages have been delayed alert.
For information about other insights in the Mail flow dashboard, see Mail flow insights in the Security & Compliance Center.