Notification on Quarantine mail

[cllee]

Hi,

In Security & Compliance > Threat Management > Review, is it possible for the administrator to receive an email notification every time there is an email quarantine regardless of which policy it hit?

Thanks.

[#2]

@cllee Hello, why would one want to achieve that? Imagine the massive amount of notifications you'd get. I assume you're familiar with working from within the center (or using by PowerShell) but I'am attaching the link anyway ;)

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/manage-quarantined-messa...

[#3]

@ChristianBergstrom 

We don't get so many quarantine. But i would like to screen-through it to take the necessary action. But at the moment i am doing this manual refresh periodically.

From the link u provided, at the bottom of the page; the powershell options doesn't have any email notification setting? Am i missing something?

Thanks

[#4]

@cllee (don't know it the previous one was successful so I'm posting it again...)

If it has to be you, one option is to change configuration in the default spam filter policy https://protection.office.com/antispam and redirect them. But why don't you just enable 'end-user spam notifications' so you don't have to bother? Another option would be Alert polices, it's not explicit an option for the word 'quarantine' but close enough and you have several options https://protection.office.com/alertpolicies

If it still isn't what you're looking for I'm afraid I cannot assist any further.

[#5]

@ChristianBergstrom 
Appreciate your response. Yes, I have explore both the option you proposed.

Antispam option will only redirect as you highlighted, in the event if i want to release to the recipient; the email will appeared as being forwarded from me. Which I want to avoid that. I want to maintain the original email, hence being release from the Quarantine page.

Alert policies i don't see any option to select Quarantine mail. The dropdown list is already preset for selection. Is there a way to configure that under Alert policies?

Thanks.