Office 365 Advanced Spam Filter
What is the Office 365 Advanced Spam Filter and Quarantine
As part of your Office 365 subscription, RODIN has set up a quarantine for incoming email messages in Office 365, where messages that have been filtered as spam, bulk mail, phishing mail, and mail that contains malware. By default, filtered messages are sent to your own personal quarantine.
How to access your Quarantine
To go directly to the Quarantine page in the Security & Compliance Center, use this URL: > https://protection.office.com/quarantine.
Manage your quarantined messages
By default, the Security & Compliance Center displays all email messages that have been quarantined as spam. The messages are sorted from newest to oldest based on the Date the message was received. Sender, Subject, and the expiration date (under Expires) are also displayed for each message. You can sort on a field by clicking the corresponding column header; click a column header a second time to reverse the sort order.
You can view a list of all quarantined messages, or you can search for specific messages by filtering. You can only do bulk operations on up to 100 items, so filtering can also help reduce your result set if you have more than that. You can quickly filter messages for a single quarantine reason by choosing an option from the drop-down list. Options include:
- Mail identified as spam. These quarantined messages are shown by default.
- Mail identified as bulk email.
After you find a specific quarantined message, click the message to view details about it and take actions. You can release the message to your mailbox, preview the message, download the message.
After you select a message or group of messages, you have several options for managing messages in quarantine:
- Do nothing – If you choose to do nothing, the message will be deleted by Office 365 automatically upon expiration. Remember, when Office 365 deletes a message from quarantine, you can’t get it back.
- Release message – Release a quarantined message (or set of messages) so that the message is sent to your mailbox. When you release a message, you have the option to report the message to Microsoft for analysis.
- Report message – When you choose to report a message, also called reporting a message as a false positive, the message is reported to the Microsoft Spam Analysis Team. The team evaluates and analyzes false positive messages and depending on the results of the analysis, the service-wide spam content filter rules may be adjusted to allow these messages through.
- Download message – Lets you download the message as .eml file. Once you download a message, you can review the .eml file using your email client prior to releasing the message.
By default, spam and bulk messages are kept in quarantine for 30 days. However, time period is configurable and your admin might have set a different quarantine retention period. When Office 365 deletes a message from quarantine, you can’t get it back.
User spam notifications
You will receive a notification message every day that lists messages addressed to your mailbox that were identified as spam and quarantined instead.
The message you receive includes the number of spam-quarantined messages you have, and the date and time (in Universal Coordinated Time or UTC) of the last message in the list. The list includes the following for each message:
- Sender – The send name and email address of the quarantined message.
- Subject – The subject line text of the quarantined message.
- Date – The date and time (in UTC) that the message was quarantined.
These are the actions that you can take with quarantined message:
- Block sender – If you want Office 365 to add the sender to your blocked senders list.
- Review – To navigate to the Quarantine Portal within the Security & Compliance Center if you want to take other actions such as Preview or Release.