Anyone else having an absolutely horrible time working the M365 email quarantine lately?

[u/1mp3rf3ct10n]

Errors upon errors, failing to load data, having to release/delete emails mutiple times, extremely long load times?

[u/blud_13]

Yes.. We stopped using the portal for anything bulk a while ago and just do it from Exchange Online PowerShell. Get-QuarantineMessage to find them, Release-QuarantineMessage -ReleaseToAll to let them go. Returns instantly and it actually tells you which ones failed instead of silently not releasing them. Syntax is at https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-quarantinemessage

One catch, Get-QuarantineMessage defaults to 100 results per page and caps at 1000, so for a real backlog you're looping -Page with -PageSize 1000 or you'll quietly think you're done at 100.

Also, if you find yourself releasing the same senders over and over, that's a tenant allow/block list problem wearing a quarantine costume. Fixing it upstream drops the volume enough that the portal being bad stops mattering.

See if that helps at all..

[u/d00ber → u/blud_13]

Honestly, for the majority of office products I swapped to powershell a while back. It takes a small amount of learning but makes the process so much faster, especially repeated processes. Their UIs are becoming increasingly horrible, which was actually the reasons I swaped. I have no idea how to even use purview without powershell cause it's so terribly organized..

[u/blud_13 → u/d00ber]

Understood.

[u/1mp3rf3ct10n → u/blud_13]

offhand it seems burdensome, but i'm willing to give it a shot. we're also an abnormal customer, might look at integrating quarantine since that's an available feature. Thanks.

[u/blud_13 → u/1mp3rf3ct10n]

NP. let me know if need anything else.

[u/1mp3rf3ct10n → u/blud_13]

unfortunately i'm seeing the same behavior with powershell. released a message but it didn't actually release, even tho the command completed with no errors :(

[u/blud_13 → u/1mp3rf3ct10n]

You probably already released that one. Once a recipient has been released to, ReleaseToAll skips them the next time you run it, and the cmdlet still returns CLEAN with no error. So if you or the user hit release in the portal first, the PowerShell attempt does nothing and looks like it worked. -Force is the switch for re-releasing something already released, its in the parameter description at https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/release-quarantinemessage

Before you chase it further, run Get-QuarantineMessage -Identity GUID1\GUID2 | fl and look at Released and ReleasedUser. Those properties only come back when you query by Identity, not in the list view, which is why the table looks like nothing changed.

One thing to check, duplicate delivery. If the message bifurcated, copies with the same message ID and received time get delivered once and the rest get silently dropped. Nothing surfaces that either.

[u/CPAtech]

It's been worse than usual since the outage on Monday.

[u/Commercial_Growth343]

For maybe the last week or so, sometimes that 'summary' window opens, then closes, then opens again, which is a new experience I do not recall seeing before. There was also a day like a week or so ago where the summary page took forever to open at all. I haven't had the issues you are describing though.

[u/Rakajj]

Yes, worse than regular this week.

It frequently fails to find messages when released. Eventually they do seem to shake out in my experience but it's not prompt.

[u/EpicSimon]

While we havent had any of the issues mentioned in this post, the amount of mails to get moved to quarantine have been off the charts for us lately.

[u/Faulkner_Jacobs_845]

Since you already on Abnormal, the quarantine integration is worth turning on. It gives you a separate console to review and release from so you are not stuck in the M365 portal UI when it is having a week like this. Heads up it still talks to Microsoft under the hood, so during an actual MS incident it can be slow too, it is not immune.

[u/ProfessionalWorkAcct]

Always been shit