← Back to the guide

Defender for Office 365 quarantine workflow

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M

solvingmicrosoft365.com

1 / 8

Defender for Office 365 quarantine workflow

How users and admins work with quarantine — release, request, report, and the policy decisions behind it.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-quarantine-workflow

Slide 1Download PNG

M

solvingmicrosoft365.com

2 / 8

01

What goes to quarantine

Messages are quarantined based on filter outcome:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-quarantine-workflow

Slide 2Download PNG

M

solvingmicrosoft365.com

3 / 8

02

Quarantine policies

A quarantine policy defines:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-quarantine-workflow

Slide 3Download PNG

M

solvingmicrosoft365.com

4 / 8

03

User notifications

When configured, users receive a periodic notification email listing recently quarantined messages with summary info and links to act on them. Configurable cadence — usually daily.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-quarantine-workflow

Slide 4Download PNG

M

solvingmicrosoft365.com

5 / 8

04

User actions

Depending on policy, users can:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-quarantine-workflow

Slide 5Download PNG

M

solvingmicrosoft365.com

6 / 8

05

Admin actions

The full admin quarantine view at security.microsoft.com/quarantine:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-quarantine-workflow

Slide 6Download PNG

M

solvingmicrosoft365.com

7 / 8

06

Default retention

Quarantined messages are retained for 30 days by default, then auto-deleted. Configurable per policy (down to a minimum or up to 30 days maximum).

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-quarantine-workflow

Slide 7Download PNG

M

solvingmicrosoft365.com

8 / 8

07

Common configuration patterns

A reasonable starting baseline:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-quarantine-workflow

Slide 8Download PNG

Auto-generated from Defender for Office 365 quarantine workflow. This page is not indexed and isn't part of the guide itself.