Emails which have been flagged as malicious will be sent directly to Quarantine, which resides in Defender. 


Releasing an email from Quarantine requires a Security Administrator who can then action the following task. 

  • Andy McConnell
  • Red Hamel
  • David Spooner
  • Nirav Patel
  • Steve Rose


1. Within Azure, locate PIM and within 'Eligible Assignments' activate Security Administrator - ensure this is done first before opening Defender. 
2. In the Defender Portal, on the left side-bar, open up Email & Collaboration

3. Select Review, and then Quarantine



4. Within the Quarantine, select the email you wish to release and then 'Release'