Managing Spam and Quarantine (Exchange Online Protection)

Exchange Online Protection (EOP) is the baseline mail-filtering service Microsoft includes with every Pitt mailbox. It evaluates inbound messages for spam, bulk mail, phishing, and malware, then either delivers them, drops them in your Junk Email folder, or holds them in quarantine. This article explains the difference between Junk Email and quarantine, how to review and release quarantined messages, how to customize your safe-sender and blocked-sender lists, and how to report missed spam or phishing. For details on the second protection layer (Defender for Office 365, Safe Links, and Safe Attachments), see Email Protection: Defender for Office 365.

How EOP Filters Your Mail

Every message arriving at your Pitt inbox is evaluated against multiple filtering layers — connection filtering, anti-malware scanning, anti-spam scanning, and anti-phishing analysis. Each layer produces a verdict, and the verdict determines what happens to the message.

Junk Email Folder vs. Quarantine

The two destinations for filtered mail behave differently and live in different places. Knowing which to check is half the battle when a message goes missing.

Reviewing Quarantined Messages

There are two ways to see what is in your quarantine: wait for a periodic notification, or go directly to the quarantine portal. Both ultimately land you in the same place — the Microsoft Defender portal — and either is fine.

Option A: Quarantine Notification Messages

On a regular schedule (more often when you receive more quarantined mail, less often when you don't), Microsoft sends a digest of recently quarantined messages to your Pitt inbox. You can identify the notification by:

• Sender: EOP ESN <quarantine@messaging.microsoft.com>
• Subject: typically "Microsoft 365 security: You have messages in quarantine" (Microsoft adjusts this from time to time)

The notification lists each newly quarantined message and offers three action buttons next to each:

• Review Message — opens the message in the Microsoft Defender portal so you can see the body, headers, and the reason it was quarantined. From there you can release, block, or delete it.
• Release — delivers the message to your inbox. See the Releasing a Quarantined Message section below before using this — there is a right way and a wrong way to use it.
• Block sender — adds the sender to your personal Blocked Senders list. Future messages from that sender will be routed to Junk Email or remain in quarantine.

Option B: Direct Access to the Quarantine Portal

You can review and act on quarantined messages at any time, without waiting for a notification:

1. Go directly to security.microsoft.com/quarantine and sign in with your Pitt account. You can also launch the same destination from Spam and Virus Filtering on myPitt.
2. If you navigate away and need to find your way back inside the Defender portal, select Email & collaboration in the left menu, then Review, then Quarantine.

3. On the Email tab, you will see your quarantined messages with columns for Subject, Sender, Received, Quarantine reason, and Expires.
4. Use the Filter control to narrow the list by sender, recipient, date range, or quarantine reason.
5. Select a message to open the details flyout, which shows headers, a preview where permitted, and the actions available for that message.

Releasing a Quarantined Message

Releasing a message delivers it from quarantine to your inbox. Once a message is in your inbox, the protections that filtered it out no longer apply — which makes this step worth slowing down for.

Only release messages you were specifically expecting. If you don't recognize the sender, weren't expecting the message, and cannot independently confirm it is legitimate — for example, by calling or texting the sender at a number you already had — leave the message in quarantine and let it expire. EOP quarantined it for a reason. The most common cause of a released-then-regretted message is releasing a message that wasn't expected in the first place.

How to Release a Message You Recognize

1. Open the message in the quarantine portal at security.microsoft.com/quarantine.
2. Use Preview message to confirm the content matches what you were expecting from that sender. If it does not, do not release it.
3. Select Release email. The message is delivered to your inbox.

For high-confidence phishing and malware, the only action available to you is Request release. Microsoft does not allow direct user release of these categories regardless of how the quarantine policy is otherwise configured — a deliberate safeguard against social-engineering pressure to release confirmed malicious mail. An administrator must approve before delivery, and the status will read Release requested until they do.

Other Actions in the Quarantine Details Flyout

• Preview message — view the message body safely without releasing it.
• View message headers — useful when forwarding technical details to the Help Desk.
• Block sender — adds the sender to your personal Blocked Senders list so future messages bypass your inbox.
• Delete from quarantine — removes the message immediately rather than waiting for the expiration date.

Customizing Your Filtering

You can refine how EOP treats mail you receive in three ways: safe senders, blocked senders, and your bulk-mail preference.

Safe Senders and Blocked Senders in Outlook on the Web

1. Open Pitt Email (Outlook) via myPitt.
2. Select the gear icon in the upper right.
3. In the Settings search box, type senders and select Junk email. (You can also navigate to Mail > Junk email.)
4. Use + Add safe sender to add an address or domain whose mail should never be filtered as junk, or + Add blocked sender to add one whose mail should always be sent to Junk Email.
5. Optionally, select Trust email from my contacts to automatically treat anyone in your Contacts as a safe sender.
6. Select Save.

To edit an entry, select it and use the pencil icon to modify or the trash icon to remove. Always select Save after changes.

Safe Senders and Blocked Senders in Classic Outlook (Desktop)

1. Right-click any message in your inbox.
2. Hover over Block and select Junk Email Options.
3. Use the Safe Senders tab to add trusted addresses or domains. Select Also trust email from my Contacts to extend the same treatment to your contacts.
4. Use the Blocked Senders tab to add addresses or domains whose mail should be routed to Junk Email.
5. Select OK.

You can also block a single sender quickly: right-click the message and select Block > Block Sender. The sender's address is added to your Blocked Senders list automatically.

Bulk-Mail Filtering Preference

Bulk mail — marketing newsletters, mass announcements, and promotional messages from legitimate senders — sits between clean mail and spam. Some people want it delivered; others want it filtered. You can set your preference at the account level:

1. Open Manage My Account via myPitt.
2. Select Email & Messaging, then Set Email Preferences.
3. Select the Filtering tab.
4. Choose your bulk-mail aggressiveness and save.

For details, see Customize Your Email Filtering.

Reporting Spam and Phishing That Reached Your Inbox

EOP is signature- and reputation-based, and no signature catches every message. When something gets through, reporting it improves filtering for you and everyone else at Pitt.

Reporting Spam

For ordinary spam (unwanted but not dangerous) that landed in your inbox, mark it as junk so EOP learns from the verdict.

• Outlook on the web: Select the message, then select Report > Report junk on the ribbon. The message moves to your Junk Email folder and the verdict is sent to Microsoft.
• Classic Outlook (desktop): Right-click the message, hover over Junk, and select Junk or Block Sender.

Reporting Phishing

For suspected phishing, use the dedicated phishing-reporting path, not the spam path — Pitt Digital Security needs the message's full metadata to investigate, and the phishing-report path preserves it.

See Phishing Emails: Don't Take the "Bait" for the full preference order. In short:

1. Preferred: Use the KnowBe4 Phish Alert Button (PAB) in Outlook. See Reporting Phishing Emails Using KnowBe4's Hybrid Phish Alert Button.
2. Alternative: Use Outlook's built-in Report > Report phishing.
3. Last resort: Forward the message as an attachment (not a standard forward) to phish@pitt.edu.

Frequently Asked Questions

Select a question to expand the answer.