What you’re seeing
- A customer insists they sent a purchase order, but it never reached the inbox or the Junk Email folder.
- Scan-to-email messages from the office copier disappear, while scans to a personal Gmail address arrive fine.
- The message turns up in the Microsoft 365 quarantine portal marked as phishing, high-confidence phishing or spoof.
- Users never get a quarantine notification email, so they have no idea anything is being held.
- When a user does find the message, the Release button is greyed out and only an admin can free it.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The default quarantine policy for phishing and high-confidence phishing lets only administrators release messages and sends no user notifications.
- End-user quarantine notifications are switched off in the quarantine policy, which is the out-of-the-box setting for several threat types.
- A copier, line-of-business app or website form sends using your own domain but fails SPF, DKIM or DMARC, so Defender treats it as spoofing.
- An external sender's domain has broken or missing authentication records, which pushes their score into the phishing range.
- A transport rule or anti-spam policy created years ago routes certain keywords or attachment types straight to quarantine.
Why it matters
Quarantined mail is worse than spam-foldered mail because nobody sees it unless they know to look. Orders, signed contracts, payment confirmations and internal scans sit in a hidden queue until they expire, typically after 30 days, and then they are gone. Staff start distrusting email and resorting to phone calls or personal accounts, which creates its own security gaps. Meanwhile the one admin who can release messages becomes a bottleneck for the whole office.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Why doesn't Microsoft tell users their mail was quarantined?
Notifications are controlled per quarantine policy, and several default policies have them turned off. Phishing verdicts are also deliberately limited to admin release, because releasing a real phish is dangerous.
Is it safe to just turn quarantine off?
No. Quarantine stops real phishing and malware. The right outcome is tuning so genuine senders and your own devices authenticate properly, while dangerous mail is still held.
Can you help us sort this out remotely?
Yes. A certified US engineer reviews your quarantine and authentication settings over a remote secure session, often in a single session, from $99 and you pay only when it's resolved.