Microsoft Defender for Office 365: Move email messages to quarantine with a new remediation action

Microsoft Defender for Office 365 Plan 2 introduces a new “Move to Quarantine” remediation action allowing admins to move suspicious emails from user mailboxes to Defender quarantine for safer investigation and management. It rolls out worldwide from November to December 2026, requiring no user action but recommended policy reviews and training updates. We are introducing Move to Quarantine, a new remediation action in Microsoft Defender for Office 365. It enables security teams to move potentially malicious email messages from users’ mailboxes directly to Microsoft Defender quarantine. This provides a safer and more flexible way to contain suspicious messages that bypassed initial detection while preserving the ability to investigate, release, or permanently delete them later. This capability is available with Microsoft Defender for Office 365 Plan 2, including eligible Microsoft 365 subscriptions that include Plan 2. Rollout schedule General Availability (Worldwide): Beginning in early November 2026 and expected to complete by mid-December 2026 Impact on your organization Who is affected Organizations with Microsoft Defender for Office 365 Plan 2 Authorized security administrators who remediate email threats Platforms and services Microsoft Defender for Office 365, including: Threat Explorer Advanced Hunting Custom detection rules for email results Email entity and email summary experiences Unified Action Center What will happen Authorized administrators will see a new Move to Quarantine remediation action. When an administrator selects Move to Quarantine: Selected email messages are removed from user-accessible mailbox locations and placed in Microsoft Defender quarantine. Supported source locations include Inbox, Junk Email, Deleted Items, and recoverable soft-deleted locations. Admins can select the quarantine policy when using the Move to quarantine action. The selected policy determines how end users can interact with the quarantined messages. By default, quarantined messages are accessible only to admins. The remediation action and status are tracked in the Unified Action Center and related investigation experiences. Quarantined messages are identified with the quarantine reason Admin triggered. Authorized users can preview, release, or permanently delete quarantined messages according to the applicable quarantine policy. Releasing a message from quarantine delivers the message to the user’s Inbox. The Search and Purge role is required to approve […]

The post Microsoft Defender for Office 365: Move email messages to quarantine with a new remediation action appeared first on M365 Admin.