Forum Discussion
Unable to Locate email in Quarantine List
Message Trace shows the email is in Quarantine. When I go to the admin Quarantine List, I am unable to locate email in Admin Quarantine List.
3 Replies
The active EX1478331 advisory fits the difference you are seeing. Message trace can record that Exchange routed a message to the quarantine destination even when the later storage operation failed, so a successful QuarantinedEmailSecured event does not guarantee that a retrievable quarantine item exists.
Use Exchange Online PowerShell to query the exact Internet Message-ID rather than the sender or subject:
Get-QuarantineMessage -MessageId '<message-id>' -StartReceivedDate <date> -EndReceivedDate <date>
Run the same search in Microsoft Defender Explorer if your license provides it. If neither location returns the item, do not keep changing quarantine policies; collect the message trace ID, Internet Message-ID, recipient, UTC delivery time, and the EX1478331 advisory reference. Add them to a Microsoft 365 support request and ask whether the message was affected by the incident and can be recovered. The portal cannot release an item that the quarantine service failed to store.
The message might have been zapped, if you have access to explorer, best check therein.
In the message trace, it doesn't show as zapped but shows "The message was successfully delivered to the folder: DefaultFolderType:QuarantinedEmailSecured"
When I search for that email in quarantine, on that day,it has two other emails but not the one i am looking for.
In Service Health, there is an active incident (Issue ID EX1478331) that says "Some users’ email messages may not be quarantined and fail to be stored in the quarantine folder"
My issue may or may not be related to this.
