Ways to fetch quarantine files

Hi Dhwani_Shah,

Thank you for validating this directly in your tenant and for sharing the detailed results.

You are correct, and I need to clarify my previous answer.

I reused part of an older response/reference I had from a previous discussion, and in this case it was not aligned with the current public Microsoft Defender for Endpoint API documentation. That caused the confusion around the GET /api/quarantineFiles endpoint.

After reviewing the public documentation again, I could not find a Microsoft-documented public MDE API endpoint for:

GET /api/quarantineFiles

Based on your HTTP 404 test result and the current public API documentation, this endpoint should not be considered available or supported.

The quarantine-related API I was referring to is actually the documented Stop and quarantine file action:

POST /api/machines/{id}/StopAndQuarantineFile

Microsoft documentation:
https://learn.microsoft.com/en-us/defender-endpoint/api/stop-and-quarantine-file

However, this API is a response action against a specific device. It can stop execution of a file and quarantine/delete it, but it does not list existing quarantined files, expose a quarantine storage object, or provide a way to download file content from quarantine.

You are also correct regarding:

GET /api/files/{sha1-or-sha256}

That endpoint returns file profile/reputation metadata by SHA-1 or SHA-256, but it does not provide device-scoped quarantine status such as isQuarantined, quarantinePath, remediation state, or a direct mapping to a quarantine object.

Microsoft documentation:
https://learn.microsoft.com/en-us/defender-endpoint/api/get-file-information

So, to answer your original questions more accurately:

1. I am not aware of a documented public Microsoft Defender for Endpoint REST API to list or retrieve quarantined file objects.
2. I am also not aware of a documented method to directly map an alert or SHA-1/SHA-256 hash to the corresponding internal Defender quarantine storage object.
3. As a possible investigation path, you could try correlating the alert/file hash with Advanced Hunting tables such as DeviceFileEvents, DeviceEvents, alert evidence, and device timeline data, using fields like DeviceId, DeviceName, SHA1, SHA256, FileName, FolderPath, ActionType, and timestamps.

For example, the practical path would be:

• Start from the alert evidence or known SHA-1/SHA-256.
• Identify the affected device and timestamp through Advanced Hunting.
• Review the device timeline around the detection/remediation event.
• Use Live Response on the affected device if file collection or further validation is required.
• If applicable, check local Microsoft Defender Antivirus quarantine/restore options on that device.

However, this should be considered event-based correlation and investigation workflow, not a supported lookup of the internal Defender quarantine storage object.

Advanced Hunting schema documentation:
https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables

DeviceFileEvents table:
https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicefileevents-table

DeviceEvents table:
https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table

1. For recovery or collection of quarantined content, the supported options appear to remain Live Response, Defender portal capabilities, or local Microsoft Defender Antivirus tooling, depending on permissions and configuration.

Microsoft documentation about restoring quarantined files:
https://learn.microsoft.com/en-us/defender-endpoint/restore-quarantined-files-microsoft-defender-antivirus

Apologies for the confusion in my first reply, and thanks again for testing it and pointing it out. Your validation helped correct the answer and make it more accurate.