The model: verdict × quarantine policy
Each protection verdict (spam, high-confidence spam, phish, high-confidence phish, malware, bulk) maps — per anti-spam/anti-phish policy — to a QUARANTINE POLICY that defines the end-user contract: can they view it, release it themselves, only REQUEST release, block senders from it; and whether notifications go out. The three scanned instances in a typical tenant (our nightly scan) are usually: AdminOnly (no user access — right for malware/high-confidence phish), the default user-access policy (self-release — defensible for bulk/spam), and a request-release middle tier (phish — user sees it exists, admin approves).
The design rule: the more dangerous the verdict, the less user agency — nobody self-releases malware; bulk self-release saves a thousand tickets. Mismatched mappings produce both failure modes: users releasing real phish, or admins drowning in newsletter requests.
Notifications: the cadence decision
Quarantine notifications (frequency configurable down to half-daily-ish windows) are the difference between 'my mail vanishes' tickets and self-service. But cadence is a phishing surface too — users trained to click 'Release' links in notification emails will click fake ones; pair the rollout with the 'real notification looks exactly like this' comms.
Admin triage that scales
The quarantine view filtered by verdict + policy is the daily sweep; release-with-report (feeding the message back as a false-positive submission) beats bare release — it tunes the filter while freeing the message. Bulk operations by sender/subject handle campaign false-positives; and every release of a PHISH verdict deserves a second reader (the one-click that undoes the whole stack).
What to watch (proofs)
- The mapping table: each anti-spam/phish policy's verdict→quarantine-policy assignments (Get-HostedContentFilterPolicy + Get-QuarantinePolicy, both scanned) — reviewed as a grid once; drift alerts thereafter.
- Release telemetry: who released what (audit events) — self-released items later reported/ZAPped is the metric that says user agency is mis-tuned.
- Request queue latency: request-release turnaround — a slow queue teaches users to pre-forward everything externally (the shadow-routing you least want).
- Notification authenticity awareness: one phishing-sim modelled on the quarantine notification — the click rate tells you whether the pairing comms worked.