MC1171845 – (Updated) Microsoft Defender for Office 365: Enhancing the quarantine experience for administrators

Product:

Defender, Defender for Office 365, Defender XDR

Platform:

Online, US Instances, World tenant

Status:

Change type:

Admin impact, Feature update, Updated message, User impact

Links:

Details:

Summary:
Microsoft Defender for Office 365 is enhancing quarantine for admins by listing messages by individual recipients, improving backend durability, and requiring message release per user. Rollout begins January 2026, completing by March. No changes affect end users. Admins should update practices and documentation accordingly.

Details:
Updated January 9, 2026: We have updated the timeline. Thank you for your patience.
We're improving the quarantine experience in Microsoft Defender for Office 365 to deliver greater clarity, visibility, and ease of use for administrators. These updates include backend enhancements for improved durability and consistency as well as experience updates to list messages in quarantine by individual recipients to simplify navigation and management.
When this will happen:
General Availability (Worldwide and GCC): We will begin rolling out in early January 2026 (previously early November 2025) and expect to complete by end of March 2026 (previously end of February).
General Availability (GCCH and DoD): We will begin rolling out in early January 2026 (previously early December 2025) and expect to complete by end of March 2026 (previously end of February).

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2025-10-14

updated:
2026-01-10

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Quarantine Management Changes
Admins will need to manage quarantined messages individually for each recipient, increasing the time and effort required for message release.
   - roles: IT Administrators, Helpdesk Support
   - references: https://learn.microsoft.com/defender-office-365/quarantine-admin-manage-messages-files

Documentation and Practice Updates
Existing documentation and practices may become outdated, leading to confusion and potential errors in message management.
   - roles: IT Administrators, Compliance Officers
   - references: https://learn.microsoft.com/defender-office-365/mdo-about

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft is making some changes to how administrators manage quarantined emails in Microsoft Defender for Office 365. Think of it like a post office that holds onto suspicious packages before they reach their intended recipients. Previously, if multiple people were supposed to receive the same package, the post office would group them together. Now, each package will be handled separately for each recipient, making it easier for the post office staff to manage and track them.

This update means that administrators will see a list of quarantined emails organized by individual recipients rather than grouped together. This change is designed to make it easier for administrators to navigate and manage these emails. The backend improvements are like reinforcing the post office's storage room to ensure that packages are stored safely and securely.

One important change is that when administrators release emails from quarantine, they will need to do so for each recipient individually. This is like having to deliver each package to its specific address rather than dropping them all off at one location. While this may require a bit more effort, it ensures that each recipient gets their email as intended.

End users, or the people receiving the emails, won't notice any difference. The changes are mainly for the administrators who manage the quarantined emails. It's a good idea for organizations to review their current practices and update any internal documentation to reflect these changes. Additionally, communicating these updates to helpdesk or support teams will ensure everyone is on the same page.