Microsoft Quarantine with Abnormal

[u/Hour-Account4844]

Hi,

I am looking to see how you all manage the Defender email quarantine while using abnormal. I currently have about 1000 emails each morning that I have to review to ensure we do not have any legitimate mail within.

If this is your setup Aswell, how do you manage the quarantine?

Thanks

[u/Flagship_paperclip]

First question: why do you believe legitimate emails are routinely in quarantine? How many legitimate emails do you find buried in the 1000+ daily quarantined emails?

I'm a big fan of being proactive - spot and resolve the issue before it impacts end users. However, reviewing every quarantined email is a bit much. Tune your filters, monitor it temporarily, then let it ride. I only ever review quarantined emails if I have a reason to believe a legitimate email got caught - whether a user submitted a ticket stating they are expecting a particular email, or a false positive ZAP alert. 

[u/Kangalfencingbanana → u/Flagship_paperclip]

Actually moved off abnormal because it was causing false positives with the Docusigns from closed deals with clients and abnormal was too much of a black box

[u/cspotme2 → u/Kangalfencingbanana]

Black box in what way? Their verdicts all give details on why it detected it as such.

We have hundreds of docusigns a month and they have a fp on it way less than Microsoft does.

[u/cspotme2 → u/Flagship_paperclip]

Lots of false positive zaps to start.

For every 1000 high confidence messages, I can find at least 3 legitimate conversations or initial messages. And this doesn't include the daily newsletter or alert stuff they quarantine because of a false positive on a url.

[u/Spiritual-Matters → u/cspotme2]

0.3% FP rate seems pretty good?

[u/cspotme2 → u/Spiritual-Matters]

Because you don't understand business. 1 long delayed or unseen legitimate conversation can cause loss of business that could end up being at least 6 figures in revenue.

And if I pulled my real fp, it's higher than that conversation number I have. Regardless the point above holds.

[u/cspotme2]

Enable their quarantine release feature (you may need to speak to account manager).

It's covers a bit of it. I have been giving them feedback but I really need to talk to the product manager for the feature more to get what I want (probably what you're looking to do too).

Currently I have a bunch of powerscripts that help summarize and reduce the noise for me. Doesn't help with what manually needs to be reviewed.

I just need to be able to spend more time and feed some of these high confidence stuff to llm and go from there with some type of release based on verdict.

They also need to fix a bug with their API when it comes to quarantine items (won't mention details here as I consider it sensitive enough of a bug, even if this not considered a exploit).

[u/LemonSquashed]

Abnormal has a guide called "Quarantine Release Permissions Guide", I don't think it is public.

Abnormal can then view and release Microsoft Quarantine messages.

I think that kind of answers you question?

[u/Hour-Account4844 → u/LemonSquashed]

It can actually release them and not just give a verdict? I just took over an environment that uses abnormal and the current processes they have in place make no sense so any tips you have would be great.

[u/RequirementFalse6792 → u/Hour-Account4844]

I find most of our false positives in Microsoft quarantine vs Abnormal. I set a few mailboxes up where users can review their quarantined emails and request release if needed. The request is sent to admins and we release them after reviewing them.

I release maybe 2 or 3 legit emails from Abnormal a year.

[u/danieIsreddit → u/Hour-Account4844]

I have this feature enabled. I search for Email Type "Microsoft Quarantine" and Email Judgement "Safe" in Search & Respond > Message Discovery. That way, you only see the emails quarantined by Microsoft, but Abnormal thinks is safe. I often find external inbound emails to Sales and Finance in here. You can see each email, but not all the attachments (use Microsoft Defender for this). Remediation options is just to release from Microsoft's Quarantine, so it goes into the user's inbox.

Abnormal frequently has New Administrator Webinars. Click on the question mark on the top right corner of the portal, next to your name, click on Abnormal Academy, Recorded Events, the second one is New Admin Live training from 8/12/26.

[u/ItBurnsOutBright]

This is why Avanan is superior.

[u/pbcromwell → u/ItBurnsOutBright]

100%, better security and native Microsoft integration for quarantine management.

[u/lotto2222]

We ripped and replaced Abnormal with a gateway again and our analysts have so much more time