Forum Discussion
Unable to Locate email in Quarantine List
The active EX1478331 advisory fits the difference you are seeing. Message trace can record that Exchange routed a message to the quarantine destination even when the later storage operation failed, so a successful QuarantinedEmailSecured event does not guarantee that a retrievable quarantine item exists.
Use Exchange Online PowerShell to query the exact Internet Message-ID rather than the sender or subject:
Get-QuarantineMessage -MessageId '<message-id>' -StartReceivedDate <date> -EndReceivedDate <date>
Run the same search in Microsoft Defender Explorer if your license provides it. If neither location returns the item, do not keep changing quarantine policies; collect the message trace ID, Internet Message-ID, recipient, UTC delivery time, and the EX1478331 advisory reference. Add them to a Microsoft 365 support request and ask whether the message was affected by the incident and can be recovered. The portal cannot release an item that the quarantine service failed to store.