Question

Your organization uses Microsoft Defender for Office 365. Users complain that legitimate marketing newsletters are being quarantined as spam, and they cannot release these messages themselves — they must file a helpdesk ticket each time. You want end users to be able to review and release messages that were quarantined by the anti-spam policy, without granting them the ability to release messages quarantined as high-confidence phishing or malware. What should you do?

Accepted Answer

Create a custom quarantine policy that grants users the 'Limited access' or release-request permissions, and assign it to the spam and bulk quarantine actions in the anti-spam policy while leaving malware and high-confidence phishing on the default policy.

Answer

Add all affected users to the Quarantine Administrator role in the Microsoft Defender portal.

Answer

Disable zero-hour auto purge (ZAP) for spam in the anti-spam policy so messages are never quarantined.

Answer

Configure a mail flow (transport) rule that bypasses spam filtering for all messages classified as bulk.