Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Quarantine Admin Manage Messages Files

26 October 2026Doc update+7 / −6 lines

In brief

The page updates its date and link ordering, renames an existing quarantine permission entry to “View and release emails and messages from quarantine,” and adds guidance for submitting quarantined messages to Microsoft, including read permissions for Security data basics and Email & collaboration metadata.

What Defender admins need to know

Review the updated permission names and role paths when managing administrator access to quarantine actions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • You need to be assigned permissions before you can do the procedures in this article. You have the following options:

    • Microsoft Defender XDR Unified role based access control (RBAC) (If Email & collaboration > Defender for Office 365 permissions is Active. Affects the Defender portal only, not PowerShell):
      • Take action on quarantinedView and release emails and messages for all usersfrom quarantine: Security operations / Security data / Email & collaboration quarantine (manage).
      • Submit messages from quarantine to Microsoft: Security operations / Security data / Security data basics (read), Security operations / Raw data (Email & collaboration) / Email & collaboration metadata (read), and Security operations / Raw data (Email & collaboration) / Email & collaboration content: Quarantine Emails (read).
      • Read-only access to quarantined messages for all users: Security operations / Security data / Security data basics (read).
      • Preview and download quarantined messages for all users: Security operations/Raw data (email & collaboration)/Email and Collaboration content: Quarantine Emails (read).
    • Email & collaboration permissions in the Microsoft Defender portal: