Use user spam notifications to release and report quarantined messages


The improved Microsoft 365 security center is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. Learn what's new.

Applies to

In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, quarantine holds potentially dangerous or unwanted messages. For more information, see Quarantined messages in EOP.

By default, end-user spam notifications are disabled in anti-spam policies. When an admin enables end-user spam notifications, recipients (including shared mailboxes with automapping enabled) will receive periodic notifications about their messages that were quarantined as spam, bulk email, or (as of April 2020) phishing.

For shared mailboxes, end-user spam notifications are only supported for users who are granted FullAccess permission to the shared mailbox. For more information, see Use the EAC to edit shared mailbox delegation.

End User Spam notification is not supported for groups.


Messages that were quarantined as high confidence phishing, malware, or by mail flow rules (also known as transport rules) are only available to admins. For more information, see Manage quarantined messages and files as an admin in EOP.

An end-user spam notification contains the following information for each quarantined message:

  • Sender: The send name and email address of the quarantined message.

  • Subject: The subject line text of the quarantined message.

  • Date: The date and time (in UTC) that the message was quarantined.

  • Block Sender: Click this link to add the sender to the Blocked Senders list on your mailbox. For more information, see Block a mail sender.

  • Release: For spam (not phishing) messages, you can release the message here without going to Quarantine the Security & Compliance Center.

  • Review: Click this link to go to Quarantine in the Security & Compliance Center, where you can (depending on why the message was quarantined) view, release, delete or report your quarantined messages. For more information, see Find and release quarantined messages as a user in EOP.

Example end-user spam notification


A blocked sender can still send you mail. Any messages from this sender that make it to your mailbox will be immediately moved to the Junk Email folder. Future messages from this sender will go to your Junk Email folder or to the end-user quarantine. If you would like to delete these messages on arrival instead of quarantining them, use mail flow Rules (also known as transport rules) to delete the messages on arrival.