As an Office 365 user, you can manage your own spam-quarantined messages in one of two ways: by responding to spam notifications sent to you directly (if your admin has set up this feature), or by using the spam quarantine feature in the Security & Compliance Center.

NOTE: If you're an admin, you can review and release quarantined messages for other people in your organization.

Follow the guidance in this topic to learn how to find and release messages that were quarantined instead of being delivered to you.

To see your spam-quarantined messages in quarantine, do the following:

1. Go to the Security and Compliance Center Quarantine page.

2. Sign in, using your Office 365 credentials (user ID and password).

3. On the Quarantine page, you'll see a list of any messages that were sent to you, but were identified as spam and redirected to the quarantine.

By default, messages are sorted from newest to oldest on the Received field. Sender, Subject, and Expires values are also listed for each message. You can sort on a field by clicking a header. If you click a column header a second time, the sort order reverses.

You can view a list of all of your quarantined messages, or you can search for specific messages by filtering. You can only do bulk operations on up to 500 items, so filtering can also help reduce the number of results if you have more than that. You can create a quick filter of messages by quarantine type (like spam) or transport rule by choosing an option in the Filters drop-down list. Or use Advanced Search for more filtering options (see the next section in this article).

Double-click a specific quarantined message to view details about it, and take actions. If the message wasn't actually spam, you can release it (have it sent to your mailbox) and report it as not junk to the Microsoft Spam Analysis Team.

Or you can select one or more messages, and then choose an action from the Actions drop-down list.

Use advanced search to filter and find quarantined messages

If you have a lot of quarantined items, you can reduce the number to a manageable set by filtering them with advanced search, using various conditions (separately or combined).

1. On the Quarantine page, choose Advanced search.

2. Choose any combination of conditions by selecting the check boxes next to them (note that you can't use wildcards at this time). There are several conditions you can choose, including the following:

   • Message ID Use this to select a specific message when you know the message ID.

     For example, if a specific message is sent by, or intended for, a user in your organization, but it never reached its destination, you can search for the message by using a message trace (see Run a Message trace and View Results). If you discover that the message was sent to the quarantine, perhaps because it matched a rule or was identified as spam, you can then easily find this message in the quarantine by specifying its Message ID. Be sure to include the full Message ID string. This might include angle brackets (<>).

   • Received You can select messages that were sent to quarantine within the past 24 hours (Today), within the past 48 hours (Last 2 days), within the past week (Last 7 days), or you can select a custom time interval.

   • Expires You can select messages that will be deleted from quarantine within the past 24 hours (Today), within the past 48 hours (Last 2 days), within the past week (Last 7 days), or you can select a custom time interval.

     IMPORTANT: By default, spam, bulk, and phishing quarantined messages are kept in quarantine for 15 days. Quarantined messages that matched a transport rule are kept in quarantine for 7 days (you can't customize this). When Office 365 deletes the messages from quarantine, you can't get them back. If you like, you can change the retention period for quarantined messages by using the Retain spam for (days) setting in your content filter policies.

   • Type Choose this condition to search for quarantined messages that have been identified as Spam, Bulk, or Phish, or for messages that matched a Transport rule.

3. Choose Search to start the search. (To see all the messages in quarantine again, just clear the check boxes in the Advanced search window.)

View details for a specific message

After you select a message or group of messages, you'll see a summary of the message properties in a pane on the right side of the page.

• Message ID The unique identifier for the message.

• Sender Address Who sent the message.

• Received The intended recipient of the message.

• Subject The text of the Subject line for the message.

• Type Shows if a message has been identified as Spam, Bulk, or Phish, or matched a Transport rule.

• Expires The date when the message will be deleted from quarantine.

• Released to All email addresses (if any) to which the message has been released.

• Not yet released to All email addresses (if any) to which the message has not been released. You can choose Release to if you want to release the message (more about releasing messages in the next section).

You can also get even more details about the message by choosing one of the following options:

• Preview message Lets you see raw or HTML versions of the message body text. In the HTML view, links are disabled.

• View message header Choose this link to see the message header text. To analyze the header in depth, copy the message header text to your clipboard, and then choose Microsoft Message Header Analyzer to go to the Remote Connectivity Analyzer (right-click and choose Open in a new tab if you don't want to leave Office 365 to complete this task). Paste the message header onto the page in the Message Header Analyzer section, and choose Analyze headers.

Release a quarantined message and (optionally) report it as not junk

After you select a message or group of messages and double-click to open the Message Details pane, you'll see two main options for releasing messages from quarantine.

1. Release Release a quarantined message (or set of messages) without allowing all future messages from the sender.

2. Release and add to allow list Release a quarantined message (or set of messages) and allow future messages from the sender.

Then, for each of these, you can also choose the following:

1. Report the mail to Microsoft as a false positive.

When you're releasing messages, be aware of the following:

• After you release a message, choose Refresh to refresh your data, and then double-click the message. You should see that the message has been released to the intended recipients.

• When you choose to report false positives, if the message or messages you release were quarantined as spam, bulk, or phish, the message will also be reported to the Microsoft Spam Analysis Team. The team will evaluate and analyze the message, and, depending on the results of the analysis, the service-wide spam content filter rules may be adjusted to allow the message through.