Commands › Exchange Online

Get-QuarantineMessage

Exchange Online ExchangeOnlineManagement Get-*

View quarantined messages and files in your cloud-based organization. Files are quarantined by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

Quick start script

# Get-QuarantineMessage — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-QuarantineMessage -Identity <QuarantineMessageIdentity> | Format-List

# 3. Export for evidence / drift tracking
Get-QuarantineMessage | Export-Clixml .\QuarantineMessage-$(Get-Date -Format yyyyMMdd).xml

Syntax — 2 parameter sets

Details

Get-QuarantineMessage -Identity <QuarantineMessageIdentity>
 [-EntityType <Microsoft.Exchange.Management.FfoQuarantine.EntityType>]
 [-RecipientAddress <String[]>]
 [-SenderAddress <String[]>]
 [-TeamsConversationTypes <Microsoft.Exchange.Management.FfoQuarantine.TeamsConversationType[]>]
 [<CommonParameters>]

Summary

Get-QuarantineMessage
 [-Direction <Microsoft.Exchange.Management.FfoQuarantine.QuarantineMessageDirectionEnum>]
 [-Domain <String[]>]
 [-EndExpiresDate <System.DateTime>]
 [-EndReceivedDate <System.DateTime>]
 [-EntityType <Microsoft.Exchange.Management.FfoQuarantine.EntityType>]
 [-IncludeMessagesFromBlockedSenderAddress]
 [-MessageId <String>]
 [-MyItems]
 [-Page <Int32>]
 [-PageSize <Int32>]
 [-PolicyName <String>]
 [-PolicyTypes <QuarantinePolicyTypeEnum[]>]
 [-QuarantineTypes <QuarantineMessageTypeEnum[]>]
 [-RecipientAddress <String[]>]
 [-RecipientTag <String[]>]
 [-ReleaseStatus <ReleaseStatus[]>]
 [-Reported <Boolean>]
 [-SenderAddress <String[]>]
 [-StartExpiresDate <System.DateTime>]
 [-StartReceivedDate <System.DateTime>]
 [-Subject <String>]
 [-TeamsConversationTypes <Microsoft.Exchange.Management.FfoQuarantine.TeamsConversationType[]>]
 [-Type <Microsoft.Exchange.Management.FfoQuarantine.QuarantineMessageTypeEnum>]
 [<CommonParameters>]

Parameters (24)

Parameter	Type	Required	What it controls
-Identity	QuarantineMessageIdentity	yes	The Identity parameter specifies the quarantined message that you want to view. The value is a unique quarantined message identifier in the format `GUID1\GUID2` (for example...
-Direction	QuarantineMessageDirectionEnum		The Direction parameter filters the results by incoming or outgoing messages. Valid values are:
-Domain	String[]		This parameter is reserved for internal Microsoft use.
-EndExpiresDate	DateTime		The EndExpiresDate parameter specifies the latest messages that are automatically deleted from the quarantine. Use this parameter with the StartExpiresDate parameter.
-EndReceivedDate	DateTime		The EndReceivedDate parameter specifies the latest messages to return in the results. Use this parameter with the StartReceivedDate parameter.
-EntityType	EntityType		The EntityType parameter filters the results by EntityType. Valid values are:
-IncludeMessagesFromBlockedSenderAddress	SwitchParameter		The IncludeMessagesFromBlockedSenderAddress switch specifies whether to include quarantined messages from blocked senders in the results. You don't need to specify a value with this switch.
-MessageId	String		The MessageId parameter filters the results by the Message-ID header field of the message. This value is also known as the Client ID. The format of the Message-ID depends on the messaging server that sent the...
-MyItems	SwitchParameter		The MyItems switch filters the results by messages where you (the user that's running the command) are the recipient. You don't need to specify a value with this switch.
-Page	Int32		The Page parameter specifies the page number of the results you want to view. Valid input for this parameter is an integer between 1 and 1000. The default value is 1.
-PageSize	Int32		The PageSize parameter specifies the maximum number of entries per page. Valid input for this parameter is an integer between 1 and 1000. The default value is 100.
-PolicyName	String		The PolicyName parameter filters the results by the threat policy that quarantined the message (for example, an anti-malware policy or an anti-spam policy). You can use any value that uniquely identifies the policy....
-PolicyTypes	QuarantinePolicyTypeEnum[]		The PolicyTypes parameter filters the results by the type of threat policy that quarantined the message. Valid values are:
-QuarantineTypes	QuarantineMessageTypeEnum[]		The QuarantineTypes parameter filters the results by what caused the message to be quarantined. Valid values are:
-RecipientAddress	String[]		The RecipientAddress parameter filters the results by the recipient's email address. You can specify multiple values separated by commas.
-RecipientTag	String[]		The RecipientTag parameter filters the results by the recipient's user tag value (for example, `Priority Account`). For more information about user tags, see [User tags in Defender for Office...
-ReleaseStatus	ReleaseStatus[]		The ReleaseStatus parameter filters the results by the release status of the message. Valid values are:
-Reported	Boolean		The Reported parameter filters the results by messages that have already been reported as false positives. Valid values are:
-SenderAddress	String[]		The SenderAddress parameter filters the results by the sender's email address. You can specify multiple values separated by commas.
-StartExpiresDate	DateTime		The StartExpiresDate parameter specifies the earliest messages that are automatically deleted from the quarantine. Use this parameter with the EndExpiresDate parameter.
-StartReceivedDate	DateTime		The StartReceivedDate parameter specifies the earliest messages to return in the results. Use this parameter with the EndReceivedDate parameter.
-Subject	String		The Subject parameter filters the results by the subject field of the message. If the value contains spaces, enclose the value in quotation marks (").
-TeamsConversationTypes	TeamsConversationType[]		This parameter is available only in Security & Compliance PowerShell.
-Type	QuarantineMessageTypeEnum		The Type parameter filters the results by what caused the message to be quarantined. Valid values are:

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.