Customizing Quarantine Notification Messages

Create a Custom Quarantine Notification with Your Own Text

A question in the Office 365 Technical Discussions Facebook group asked about customizing the email received by users when messages sent to them end up in the quarantine. These messages inform users that quarantined messages require their review to decide whether to release or remove the items. When a user releases a message, the action is a signal to Exchange Online Protection that the decision to quarantine the message is a false positive. Depending on how you configure Exchange Online Protection, different amounts of email end up in quarantine. For instance, my experience of blocking user safe sender lists in favor of using tenant-wide blocks is that Exchange Online Protection quarantines more messages.

Tenants can update the global quarantine settings to customize the standard message form used to send information about quarantined messages. The GUI in the Microsoft Defender portal (Figure 1) allows tenants to create customized notifications for up to three languages. On the surface, filling in the different values and saving them seems easy, but despite many attempts, it never worked for me.

I’m not saying that the problem lies with the Defender portal. It is entirely possible that I did something silly and continued doing the same thing with the same effect: the only change to the notification message was the substitution of the Microsoft logo with the logo used in the Microsoft 365 theme for the organization.

Updating Custom Quarantine Notification Settings with PowerShell

Where there’s a will, there’s a way. Reading further inti the documentation, we discover that it’s possible to update the settings with PowerShell. The exact syntax is a little funky because the Set-QuarantinePolicy cmdlet barfs if you don’t update all the settings for a selected language. And if you update the setting for one language, make sure that you update settings for all the languages used in the tenant. Unfortunately, the documentation is not as clear as you’d like it to be when updating just the default language settings through PowerShell, but some experimentation soon arrived at the right formula.

Here’s what I ran to update the default settings:

Get-QuarantinePolicy -QuarantinePolicyType GlobalQuarantinePolicy | Set-QuarantinePolicy -MultiLanguageSetting ('Default') -MultiLanguageCustomDisclaimer ('For more information, contact the wonderful Help Desk.') -ESNCustomSubject ('Quarantined messages are waiting for your review') -MultiLanguageSenderName ('Office 365 administrator') -EndUserSpamNotificationCustomFromAddress customer.services@office365itpros.com

After running Set-QuarantinePolicy, you can check the updated settings by running Get-QuarantinePolicy: People who use Microsoft 365 in U.S. English will see the custom values in quarantine notifications after the service percolates the new values across the mailbox servers that handle traffic for the tenant.

Here’s another example. In this instance, we update the default and two other languages (you select the languages and provide the translated values) with values passed for each language:

Get-QuarantinePolicy -QuarantinePolicyType GlobalQuarantinePolicy | Set-QuarantinePolicy -MultiLanguageSetting ('Default','French','German') -MultiLanguageCustomDisclaimer ('For more information, contact the wonderful Help Desk.','Pour plus d`'informations, contactez le merveilleux Help Desk.', 'Für weitere Informationen wenden Sie sich bitte an den wunderbaren Helpdesk') -ESNCustomSubject ('Quarantined messages are waiting for your review','Les messages mis en quarantaine attendent votre examen', 'Unter Quarantäne gestellte Nachrichten warten auf Ihre Überprüfung') -MultiLanguageSenderName ('Office 365 administrator','Administrateur Office 365', 'Office 365-Administrator') -EndUserSpamNotificationCustomFromAddress customer.services@office365itpros.com

As I am in Ireland, the changes made to these languages didn’t help me one iota. The trick is to configure “English” as a language (or English_Great Britain as shown by the Defender portal). I removed French and German and added English, ending up with this configuration:

Get-QuarantinePolicy -QuarantinePolicyType GlobalQuarantinePolicy  | Format-list enduserspamnotificationcustomfromaddress, esncustomsubject, multilanguagecustomdisclaimer, multilanguagesetting

EndUserSpamNotificationCustomFromAddress : customer.services@office365itpros.com
EsnCustomSubject                         : {Quarantined messages are waiting for your review, You have somequarantined messages to deal with}
MultiLanguageCustomDisclaimer            : {For more information, contact the wonderful Help Desk., Quarantined messages might be not what you think they are...}
MultiLanguageSetting                     : {Default, English}

And Then Everything Clicked for Custom Quarantine Notifications

For whatever reason, fiddling around with PowerShell to update languages seemed to do the trick and the Defender portal started to co-operate (Figure 2). I can’t account for why this should happen, or if it will happen in another tenant.

Through the magic of PowerShell, Irish users now receive custom quarantine notifications (Figure 3). I am chuffed that one of the first notifications to arrive in a custom form concerned email received from Paul Robichaux, a well-known doubtful personality in the Exchange world. Clearly Exchange Online Protection is focused on Paul’s activity.

Baffled and Bemused

I wish I knew why I was initially unsuccessful at persuading the Defender portal to accept my attempts at customizing quarantine notifications. Thankfully, the PowerShell route eased my way to eventual success, but having an unexplained mystery always leaves me baffled and bemused, and that’s not a great place to be. It could just be the difference between English and English.…

---

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.