Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Quarantine Policies

4 September 2026Doc update+14 / −5 lines

In brief

The page now explains quarantine policies for Safe Attachments scanning and blocked encrypted attachments, documents related PowerShell parameters and default-policy behavior, and clarifies Get-QuarantineMessage permission properties.

What Defender admins need to know

Administrators can use the updated guidance to configure the appropriate quarantine policies and correctly interpret permission values returned by the cmdlet.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  1. On the Settings page or flyout, view or select a quarantine policy in the following boxes:

    • Quarantine policy box.in the Safe Attachments unknown malware response section: This quarantine policy applies to messages quarantined by Safe Attachments scanning.

      Users can't release their own messages quarantined as malware or phishing by Safe Attachments policies, regardless of how the quarantine policy is configured. If the policy is configured for users to release these quarantined messages, users are instead allowed to request the release of these quarantined messages.

    • Quarantine policy in the Block messages containing encrypted attachments that could not be scanned section (available when you select Block unscanned attachments): This quarantine policy applies to messages quarantined because they contain encrypted (password-protected) attachments that can't be scanned.

    :::image type="content" source="media/quarantine-tags-in-safe-attachments-policies.png" alt-text="The Quarantine policy selections in a Safe Attachments policy." lightbox="media/quarantine-tags-in-safe-attachments-policies.png":::

Safe Attachments policies in PowerShell

If you'd rather use Exchange Online PowerShell to assign quarantine policies in Safe Attachments policies, use the following syntax to create or update a Safe Attachments policy and optionally assign a custom quarantine policy when messages are blocked or dynamically delivered:delivered, or when messages contain encrypted (password-protected) attachments that can't be scanned:

<New-SafeAttachmentPolicy -Name "<Unique name>" | Set-SafeAttachmentPolicy -Identity "<Policy name>"> -Enable $true -Action <Block | DynamicDelivery> [-QuarantineTag <QuarantineTagName>] [-EnableBlockingEncryptedAttachments $true] [-QuarantineTagForBlockingEncryptedAttachments <QuarantineTagName>]

  • The Action parameter values Block or DynamicDelivery can result in quarantined messages (the value Allow doesn't quarantine messages). The value of the Action parameter is meaningful only when the value of the Enable parameter is $true. Get-SafeAttachmentPolicy | Format-List Name,Enable,Action,QuarantineTag

  • When you use the EnableBlockingEncryptedAttachments parameter value $true (the Block unscanned attachments setting) without using the QuarantineTagForBlockingEncryptedAttachments parameter, the default quarantine policy named DefaultFullAccessWithNotificationPolicy is used for messages that are quarantined because they contain encrypted (password-protected) attachments that can't be scanned. This setting is meaningful only when the value of the Action parameter is Block.

  • A new Safe Attachments policy in PowerShell requires a safe attachment policy using the New-SafeAttachmentPolicy cmdlet (settings), and an exclusive safe attachment rule using the New-SafeAttachmentRule cmdlet (recipient filters). For instructions, see Use Exchange Online PowerShell to configure Safe Attachments policies.

This example creates a Safe Attachments policy named Research Department that blocks detected messages and assigns the NoAccess quarantine policy (No access permissions) to quarantined messages. Get-QuarantinePolicy -QuarantinePolicyType GlobalQuarantinePolicy


For detailed syntax and parameter information, see [Get-QuarantinePolicy](/powershell/module/exchangepowershell/get-quarantinepolicy)

For detailed syntax and parameter information, see Get-QuarantinePolicy. ##

Modify quarantine policies in the Microsoft Defender portal