Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Quarantine or block specific (pre-existing) emails?

Steel Contributor

Forgive me if this is the wrong group.

 

Office 365/E3. Some of our users have been receiving a specific phishing email today in their regular inbox (from the same sender, same subject line, payload, attachments) that attempts to phish their Google Doc login details.

 

Is there any way for me to, as a global admin, to search for and somehow "quarantine" (not sure if that's the right term) these specific existing mails across the tenant/organization? I don't want users to continue to click on these emails as they encounter them in their inbox. Going forward I know I can somehow block them, but what to do about all the ones that have already been delivered/received?

 

Thanks,

Bob

2 Replies
best response
Solution

Best you can do is purge them via Search-Mailbox. Or simply report them (https://technet.microsoft.com/en-us/library/jj200769(v=exchg.150).aspx) and let ZAP do it's magic.

Thanks, Vasil!
1 best response

Accepted Solutions
best response
Solution

Best you can do is purge them via Search-Mailbox. Or simply report them (https://technet.microsoft.com/en-us/library/jj200769(v=exchg.150).aspx) and let ZAP do it's magic.

View solution in original post