Microsoft Defender for Office 365
Email and collaborationQuarantine Shared Mailbox Messages
In brief
The documentation now states that users can manage quarantined messages sent to shared mailboxes without automapping. Access through quarantine notifications requires an enabled quarantine policy, notification access, and Full Access permissions to the shared mailbox.
What Defender admins need to know
Review quarantine policies and shared mailbox permissions to ensure intended users can access quarantined messages.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Previously, the ability for users to manage quarantined messages sent to a shared mailbox required admins to leave automapping enabled for the shared mailbox (it's enabled by default when an admin gives a user access to another mailbox). However, depending on the size and number of mailboxes that the user has access to, performance can suffer as Outlook tries to open all mailboxes that the user has access to. Because Outlook performance can suffer when it tries to open all accessible mailboxes, many admins choose to remove automapping for shared mailboxes.
AutomappingNow, automapping is no longer required for users to manage quarantined messages inthat were sent to shared mailboxes.
There are two different methods to access quarantined messages:messages that were sent to a shared mailbox:
The user can selectReviewin quarantine notifications to go to quarantine in the Microsoft Defender portal if all ofIf the followingconditionsstatements aremet:all true:- An admin has configured quarantine policies to allow quarantine
notifications.notifications (formerly known as end-user spam notifications). - The user has access to quarantine notifications
forof the shared mailbox. - The user has Full Access permissions to the shared mailbox (assigned directly or through a cloud-only security group)
, or is the owner of the mailbox..
This methodThe user can select Review in the notification to go to quarantine in the Microsoft Defender portal. Selecting Review in the quarantine notification only allows access to quarantined messages that were sent to the shared mailbox. Users can't manage their own quarantine messages when they access quarantine by selecting Reviewinthis context.a shared mailbox notification.- An admin has configured quarantine policies to allow quarantine
The user can open the Find and release quarantined messages as a user page and select Filter to filter the results by Recipient address (the email address of the shared mailbox). On the main Quarantine page, the user can select the Recipient column header to sort by messages that were sent to the shared mailbox.
@@ -29,16 +29,14 @@ Users can manage quarantined messages where they're one of the recipients as des Previously, the ability for users to manage quarantined messages sent to a shared mailbox required admins to leave automapping enabled for the shared mailbox (it's enabled by default when an admin gives a user access to another mailbox). However, depending on the size and number of mailboxes that the user has access to, performance can suffer as Outlook tries to open _all_ mailboxes that the user has access to. Because Outlook performance can suffer when it tries to open all accessible mailboxes, many admins choose to [remove automapping for shared mailboxes](/outlook/troubleshoot/profiles-and-accounts/remove-automapping-for-shared-mailbox). -Automapping is no longer required for users to manage quarantined messages in shared mailboxes.+Now, automapping is no longer required for users to manage quarantined messages that were sent to shared mailboxes. There are two different methods to access quarantined messages that were sent to a shared mailbox: -There are two methods to access quarantined messages:+- If the following statements are all true:+ - An admin has configured [quarantine policies](quarantine-policies.md#anatomy-of-a-quarantine-policy) to allow quarantine notifications (formerly known as end-user spam notifications).+ - The user has access to quarantine notifications of the shared mailbox.+ - The user has Full Access permissions to the shared mailbox (assigned directly or through a cloud-only security group). -- The user can select **Review** in quarantine notifications to go to quarantine in the Microsoft Defender portal if all of the following conditions are met:- - An admin has configured [quarantine policies](quarantine-policies.md#anatomy-of-a-quarantine-policy) to allow quarantine notifications.- - The user has access to quarantine notifications for the mailbox.- - The user has Full Access permissions to the shared mailbox (assigned directly or through a cloud-only security group), or is the owner of the mailbox.-- This method only allows access to quarantined messages that were sent to the shared mailbox. Users can't manage their own quarantine messages in this context.+ The user can select **Review** in the notification to go to quarantine in the Microsoft Defender portal. Selecting **Review** in the quarantine notification only allows access to quarantined messages that were sent to the shared mailbox. Users can't manage their own quarantine messages when they access quarantine by selecting **Review** in a shared mailbox notification. - The user can open the [Find and release quarantined messages as a user](quarantine-end-user.md) page and select **Filter** to filter the results by **Recipient address** (the email address of the shared mailbox). On the main **Quarantine** page, the user can select the **Recipient** column header to sort by messages that were sent to the shared mailbox.