Email Quarantine: What Professional Staff Need to Know

Email is critical to legal and professional services — but it’s also the most common attack vector used in data breaches, invoice fraud, and impersonation attacks.

To protect client confidentiality and reduce risk, Microsoft 365 uses Email Quarantine to stop suspicious messages before they reach your inbox.

This article explains what quarantine means, how to check it, and what action staff should take.

Why Emails Are Quarantined?

Microsoft 365 automatically quarantines emails that may pose a risk to your firm, including:

• Phishing emails impersonating partners, directors, or clients
• Fake invoices or trust‑account payment requests
• Emails containing malware or malicious attachments
• Messages failing security checks such as spoofing or impersonation detection

In professional services, these risks are particularly serious — a single incorrect click can expose client data, legal documents, or financial details.

Quarantine acts as a protective holding area, allowing emails to be reviewed safely before delivery.

Does Quarantine Mean the Email Is Malicious?

Not always. Some legitimate emails (especially from new clients or external systems) can be incorrectly flagged. However, quarantine ensures those messages are reviewed before being trusted, rather than delivered automatically.

The key principle is simple:

If the email is genuinely legitimate, it can wait to be reviewed.
If it’s malicious, quarantine may prevent a serious incident.

How You’ll Be Notified

Most users receive an automated quarantine notification email showing:

• Sender
• Subject line
• Date received
• A link to review the message securely

If you are unsure about a notification email, do not click links inside it — instead access quarantine directly using the portal link below.

How to Check Quarantine in Microsoft 365

You can review your quarantined emails at any time.

Step-by-Step Instructions

1. Open a web browser and go to: https://security.microsoft.com/quarantine
2. Sign in using your work email address and password.

3. You will see a list of emails that have been quarantined for your account.

4. Select an email to view:
   • Why it was quarantined
   • Sender details
   • What actions are available to you

5. Depending on firm policy, you may be able to
   • Preview the message safely
   • Request the email be released
   • Delete the email

Some high‑risk emails (such as confirmed phishing or malware) cannot be released, even by request — this is by design.

Should You Release a Quarantined Email?

Before requesting release, consider the following:

Consider it generally acceptable to release if

• You were expecting the email
• You recognise the sender and business context
• The content aligns with prior communication

Do not release if the email if

• Requests payment, bank details, or trust changes
• Creates urgency or pressure
• Appears to come from a partner but feels unusual
• Was not expected at all

Invoice fraud and impersonation attacks are common in firms — when in doubt, do not release.

What If You’re Unsure?

If there is any uncertainty, contact Network Alliance before releasing the message.

We can:

• Review the email safely
• Validate headers, sender reputation, and impersonation signals
• Confirm whether it is legitimate or malicious

This protects the firm, your clients, and you personally.

Why This Matters for your Firm?

Email quarantine is not just an IT control — it’s part of your risk management and confidentiality obligations.

It helps protect against:

• Client data breaches
• Trust account fraud
• Business email compromise (BEC)
• Reputational and regulatory damage

A short delay is far preferable to performing an incident response.

Key Takeaways

• Quarantine exists to protect your firm and your clients
• Review quarantined emails carefully
• Never release payment or credential‑related emails without certainty
• When unsure — escalate, don’t guess

Network Alliance is here to assist with any quarantined emails you’re unsure about.