MC1171845 – M365 Change Digest

One-line summary

Defender for Office 365 quarantine will list messages by individual recipient, improving admin clarity; rollout starts early January 2026 with backend enhancements and cmdlet behavior changes.

Similar updates

Details

Summary

Microsoft Defender for Office 365 will enhance quarantine by listing messages by individual recipients, improving backend durability and consistency. Rollout starts January 2026, completing by February. Admins must release quarantined messages per user. No changes affect end users; update internal processes accordingly.

Body (from Message Center)

Updated November 12, 2025: We have updated the timeline. Thank you for your patience.

We’re improving the quarantine experience in Microsoft Defender for Office 365 to deliver greater clarity, visibility, and ease of use for administrators. These updates include backend enhancements for improved durability and consistency as well as experience updates to list messages in quarantine by individual recipients to simplify navigation and management.

When this will happen:

General Availability (Worldwide and GCC): We will begin rolling out in early January 2026 (previously early November 2025) and expect to complete by end of February 2026 (previously mid-December 2025).
General Availability (GCCH and DoD): We will begin rolling out in early January 2026 (previously early December 2025) and expect to complete by end of February 2026 (previously early January 2026).

How this affects your organization:

Who is affected: Administrators managing quarantined messages in Microsoft Defender for Office 365.
What will happen:
- Quarantined messages will now be listed by individual recipient instead of grouped by multiple recipients.
- Backend enhancements will improve durability and consistency.
- Existing quarantine release cmdlets will all remain functional. Administrators should be cognizant that `ReleaseToAll` now applies to a single user as aggregation has been removed. Admins must release messages for each intended mailbox individually.
- No changes to end-user experience.

Screenshot 1 - Updated quarantine view showing individual recipients listed separately in the Recipient column:

user settings

Screenshot 2 - Existing quarantine view showing multiple recipients in the Recipient column:

user settings

What you can do to prepare:

Review your organization’s quarantine release practices.
Update any internal documentation to reflect the new recipient-level view.
Communicate this change to helpdesk or support teams as needed.
Learn more:
- Microsoft Defender for Office 365 overview | Microsoft Learn
- Manage quarantined messages and files as an admin | Microsoft Defender for Office 365 | Microsoft Learn

Compliance considerations:

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-01-01T00:00:00Z",
    "ai_actions": [
      "Review quarantine release practices",
      "Update internal documentation",
      "Communicate changes to support teams"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Defender for Office 365 quarantine will list messages by individual recipient, improving admin clarity; rollout starts early January 2026 with backend enhancements and cmdlet behavior changes.",
    "ai_topics": [
      "Defender"
    ],
    "category": "stayInformed",
    "details_map": {
      "Summary": "Microsoft Defender for Office 365 will enhance quarantine by listing messages by individual recipients, improving backend durability and consistency. Rollout starts January 2026, completing by February. Admins must release quarantined messages per user. No changes affect end users; update internal processes accordingly."
    },
    "id": "MC1171845",
    "importance": 3,
    "is_major_change": false,
    "last_modified": "2025-11-13T18:37:01Z",
    "ms_products": [
      "Defender"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Defender XDR"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "Feature update",
      "User impact",
      "Admin impact"
    ],
    "title": "(Updated) Microsoft Defender for Office 365: Enhancing the quarantine experience for administrators"
  }
}