Quarantined Messages

The Quarantined Messages page lists the email messages quarantined across all your protected mailboxes. Messages are displayed in tabs by quarantine type. The available tabs depend on the features configured for your environment.

By default, the page shows messages processed on the current day.

You can select a date range of up to 30 days. If you have a Sophos Email Plus license, you can select a date range of up to 90 days.

The following quarantine lists are available:

Email security quarantine

This quarantine list shows messages quarantined by your standard Email Security policies. These are messages Sophos Email identified as spam, malware, or otherwise suspicious based on your inbound protection settings.

Messages remain in quarantine for 30 days.

Post-delivery quarantine

This quarantine list shows messages that were delivered to user mailboxes but later identified as malicious or risky. Sophos Email claws back these messages and adds them to the Post-delivery quarantine list.

Inbound messages and internally forwarded messages are listed separately as follows:

• Inbound messages: Subject and message details are available.

• Internally forwarded messages: Full message details aren't available.

  Internally forwarded messages include emails that were forwarded or replied to within your organization. These are supported only for Microsoft 365 mailboxes.

Messages that aren't released within 30 days are deleted.

M365 quarantine

This quarantine list shows messages quarantined by Microsoft 365.

To update the list with the latest quarantine data from Microsoft 365, click the Refresh icon. You must acknowledge the request to connect to Microsoft services before the update can be processed.

EMS mode

If you're subscribed to Sophos EMS, Sophos scans journal copies of emails but doesn't intercept or take action on the original messages. When you see messages labeled as "Quarantined" on the Quarantined Messages page, those messages aren't actually quarantined. Instead, they're delivered to the recipient's mailbox.

The quarantine status shown is a simulation of what Sophos Email would have done if it had been the active security service. Since EMS is a monitor-only tool, it doesn't block or hold the message. If a message is considered risky, you'll need to manually review or claw back the delivered email.

For more information on Sophos EMS, see Sophos EMS (Email Monitoring System).