Question

A user reports that a legitimate invoice email from a supplier was blocked and placed in quarantine as phishing. As a SOC analyst using the Microsoft Defender portal, you need to make the message available to the user's mailbox while keeping visibility of the action for the security team, and you must ensure the sender is not blocked again for a similar future message. Which sequence of actions best meets these requirements?

Accepted Answer

Release the message from the Quarantine page and submit it to Microsoft as a false positive, adding the sender to the Tenant Allow/Block List allow entry via the submission

Answer

Delete the quarantined message and instruct the user to ask the supplier to resend it from a different domain

Answer

Preview the message in quarantine and create a mail flow (transport) rule that bypasses spam filtering for all mail from the supplier's domain

Answer

Release the message and manually add the sender domain to the Tenant Allow/Block List block list to document the incident