Microsoft Defender for Office 365: New Quarantine release details

Microsoft Defender for Office 365 is rolling out new details on who or what is responsible for releasing a message from quarantine. The Release by field will be propagated with the email address of the user or admin responsible for the release. This will be available in the email summary flyout panel accessible from the Quarantine page. The release will be captured by the system. Admins should update their training documentation. The rollout will begin in late March 2024 and complete by late April 2024.

In Microsoft Defender for Office 365, we are rolling out new details on who or what is responsible for releasing a message from quarantine.

These details will now be included in the email summary flyout panel accessible from the Quarantine page.

When this will happen:

General Availability (Worldwide, GCC, GCC High): We will begin rolling out late March 2024 and expect to complete by mid-April 2024.

DoD: We will begin rolling out mid-April 2024 and expect to complete by late April 2024.

How this will affect your organization:

After a message is released from quarantine, the Release by field will be propagated with the email address of the user or admin responsible for the release.

admin controlsView image in new tab

admin controlsView image in new tab

The Release by field will also capture releases carried out by the system:

admin controlsView image in new tab

Please note that previously this information was available only in audit logs.

What you need to do to prepare:

The purpose of this communication is for awareness. Admins should also update their training documentation as they see fit. 

Learn more: Manage quarantined messages and files as an admin | Microsoft Learn

Message ID: MC744113


No comments yet

Leave a Reply


I've been working with Microsoft Technologies over the last ten years, mainly focused on creating collaboration and productivity solutions that drive the adoption of Microsoft Modern Workplace.

%d bloggers like this: