Why can't I find a missing email anywhere in my mailbox?

If it was quarantined, it never reached your mailbox at all, so an inbox or even a folder-by-folder search won't find it; you need to check your personal quarantine view instead. It's also worth checking Junk Email separately, since junk-filtered mail did arrive and sits there rather than in quarantine. If neither turns it up, ask an administrator to check for a mail flow rule or run a message trace.

Can I release a quarantined email myself, or do I need an admin?

It depends on why the message was quarantined. Lower-risk categories are often self-releasable directly from your own quarantine view. Higher-risk categories, such as malware or high-confidence phishing detections, generally can't be self-released by design; you can usually request release instead, which an administrator then approves.

What's the difference between quarantine and the Junk Email folder?

Quarantine sits before delivery and is managed centrally for the whole organisation; a quarantined message never reaches the mailbox. Junk Email is a folder inside your own mailbox that the message reaches after quarantine has already let it through, filtered there by lighter, per-mailbox junk rules. A quarantine search and a Junk Email search look in genuinely different places.

Is it safe to release a quarantined email if I recognise the sender?

Recognising the display name isn't enough on its own, since that's the easiest part of an email to fake. Check the exact sender address for a look-alike domain, check why it was quarantined, and if it involves a payment or credential request, verify through a phone number or contact you already have on file rather than one in the email. If anything feels off, it's safer to leave it and ask IT support.

Why does the same legitimate sender keep getting quarantined?

Repeated false positives from one genuine sender are commonly caused by a gap in that sender's own domain authentication (SPF, DKIM or DMARC), which makes their mail look spoofable to any filtering system it passes through. Releasing each message manually is a short-term workaround; a lasting fix usually means the sender's IT provider correcting their own authentication records, with a deliberate, reviewed allow entry as a stopgap rather than a permanent fix.

Should I ever whitelist an entire domain to stop emails being quarantined?

Only with real caution, and it's rarely the first move. A broad allow entry bypasses filtering for everything from that domain going forward, which is a meaningful trade-off if that domain is ever compromised later. Where possible, allow a specific address rather than a whole domain, review the entry periodically, and address the root cause, often the sender's own authentication set-up, rather than leaving a standing allow entry in place indefinitely.

Microsoft 365 quarantined email: the release safety checklist

"I never got that email" is one of the most common lines in a small business, and it covers at least three completely different technical situations. The message might be quarantined, held back by Microsoft 365's built-in filtering because it looked risky. It might have arrived and be sitting quietly in Junk Email, filed rather than blocked. Or it might have been intercepted and silently dropped by a mail flow rule an administrator configured, in which case there is no trace of it in the recipient's mailbox at all, quarantine included.

Each of these needs a different fix, and they are commonly mixed up. This guide covers how quarantine actually works, what a user can check and release themselves versus what only an administrator can see, a safety checklist to run through before releasing anything, and when the better fix is not to release the message at all, but to deal with why it was quarantined in the first place.

Quarantine, junk, and a silent rule are three different problems

Quarantine is a holding area operated centrally by Microsoft's filtering for the whole organisation, not by any one mailbox. A message lands there because anti-spam, anti-phishing, anti-malware, or attachment-scanning detections flagged it before it was ever delivered. It never reaches an inbox, and depending on the reason it was caught, the recipient may or may not even be told it exists.

Junk Email is different in an important way: the message did arrive. It was delivered to the mailbox and then filed into the Junk Email folder by the mailbox's own junk filtering, which is a separate, lighter layer that runs after quarantine has already let the message through. If a search of Junk Email turns it up, this was never a quarantine problem.

A mail flow rule (sometimes called a transport rule) is an administrator-defined instruction that acts on messages in transit, before they reach quarantine or junk filtering at all. It can redirect mail, add a warning banner, block it outright, or silently delete it. This is the case that looks the most like the message simply vanished, because unlike quarantine, there is often no record visible to the recipient, and depending on configuration, not always an obvious one to the administrator either without checking the rule's own logging.

What a user can check and release themselves

Most Microsoft 365 organisations give each person their own quarantine view, showing messages quarantined that were addressed to them. What a user is allowed to do with a message there, such as preview it, release it directly, or only request its release, is controlled by a quarantine policy the organisation has set, so the options available can differ between tenants and even between message categories.

1Sign in to your Microsoft 365 account through a browser and open your personal quarantine view.
2Search or filter for the missing message by sender or subject, and check the date range, since quarantined items are only held for a set number of days before automatic deletion.
3Use Preview rather than opening the message directly, to read the content without triggering links or downloading attachments.
4If the release option is available for that message, you can typically release it straight to your inbox. If it isn't, look for a request-release option instead, which sends the request to an administrator rather than releasing it outright.

By design, users generally cannot self-release the highest-risk categories, such as messages caught as malware or as high-confidence phishing, regardless of how helpful the sender seems. That restriction exists specifically so a convincing fake invoice or compromised supplier account can't be released by an in-a-hurry staff member without a second set of eyes.

What only an administrator can see and do

An administrator's view of quarantine, inside the Microsoft Defender portal, covers every mailbox in the organisation rather than one person's messages, and includes categories a user's own view may never show them at all. It also shows the specific reason a message was quarantined, which policy caught it, and message trace details that help work out whether this is a one-off or a pattern.

Release, delete, or permanently block any quarantined message across the organisation, including the high-risk categories users can only request release for.
Check message headers and the detection reason to understand why filtering acted, rather than just that it did.
Release a message to only the original recipient, rather than to everyone it was sent to, when that option is appropriate.
See and manage quarantine for shared mailboxes, which generally is not visible through an individual user's own quarantine view at all.

Before you release it: a safety checklist

A message sitting in quarantine was flagged for a reason, even if that reason turns out to be a false positive. Before releasing anything, especially anything involving money, credentials, or an attachment, run through this checklist.

Check the sender's exact address, not just the display name. Look-alike domains that swap a letter or add an extra word are built specifically to pass a quick glance.
Check why it was quarantined. A bulk or spam detection is a much lower-stakes release than a phishing or malware detection.
If the message claims to be from a known supplier, customer, or bank and involves a payment, bank detail change, or login request, verify it with that organisation through a phone number or contact you already have on file, not one in the email itself.
Use Preview instead of releasing straight to the inbox when you just need to confirm what a message is.
Never release and then open an unexpected attachment from an unfamiliar sender, even if the subject line looks routine.
If in doubt, forward the question to IT support rather than releasing it. A message that stays in quarantine an extra hour costs nothing; one that shouldn't have been released can cost a lot more.

Release vs allow entry: fixing the cause, not just the symptom

Releasing a single message is the right move for a one-off. It becomes the wrong move when the same legitimate sender gets quarantined repeatedly, because releasing it manually every time is a workaround, not a fix, and it trains staff to treat release requests as routine.

An administrator can add a deliberate allow entry so that sender's future mail bypasses that particular filtering. This is worth doing carefully rather than broadly: an allow entry should be as specific as possible (an address rather than an entire domain where practical), reviewed rather than left in place indefinitely, and treated as a known trade-off, since it does reduce the filtering protecting that path.

It is also worth checking the actual cause before reaching for an allow entry at all. A genuine, well-known business sender getting caught repeatedly is very often not Microsoft 365 being oversensitive; it's the sender's own domain having a gap in its email authentication set-up (SPF, DKIM or DMARC), which makes their mail look spoofable to every filtering system it passes through, not just yours. Where that's the cause, the durable fix sits with the sender's own IT provider correcting their authentication records, and a permanent allow entry on your side just papers over a problem that will keep resurfacing with other recipients.