Delete messages

An authorized administrator can delete messages directly from Microsoft 365 Defender quarantine, so users do not need to open or act on quarantine notifications.

Delete messages in the Defender portal

1. Open Microsoft Defender portal → Email & collaboration → Review → Quarantine → Email.
2. Select one or more messages.
3. Select Delete from quarantine on the Email tab, or open the details pane and select More options → Delete from quarantine.
4. Select Permanently delete the message from quarantine, and then select Delete.

The messages disappear from the quarantine list and are not delivered to their original recipients. This deletion is permanent and cannot be undone.^1^

The administrator needs one of these permissions:

• Microsoft Defender XDR Unified RBAC: Email & collaboration quarantine (manage)
• Defender role group: Quarantine Administrator, Security Administrator, or Organization Management
• Microsoft Entra role: Security Administrator or Global Administrator

Use the least-privileged applicable role—typically Quarantine Administrator rather than Global Administrator.^1^

Delete messages in bulk with PowerShell

For large batches, connect to Exchange Online PowerShell and retrieve the message identities with Get-QuarantineMessage. Review the list before deleting:

$messages = Get-QuarantineMessage
$messages | Select-Object Identity, ReceivedTime, SenderAddress, Subject

To delete selected messages:

$ids = $messages |
    Where-Object Subject -Like "*unwanted subject*" |
    Select-Object -ExpandProperty Identity

Delete-QuarantineMessage -Identities $ids -Identity 000

For a single message:

Delete-QuarantineMessage -Identity "GUID1\GUID2"

-Identities supports bulk deletion; the additional -Identity 000 is required by that parameter set but its value is ignored. The cmdlet is available only in the cloud-based service and requires appropriate permissions.^2^

To permanently remove the messages so they are not potentially recoverable, add -HardDelete. This is irreversible:

Delete-QuarantineMessage `
    -Identities $ids `
    -Identity 000 `
    -HardDelete `
    -Confirm:$false

Do not retrieve and delete every quarantine identity unless that is explicitly intended; filtering by recipient, sender, subject, date, or quarantine reason reduces the risk of removing legitimate messages.

If no manual action is necessary, quarantined messages are also automatically deleted when they reach the date shown in the Expires column.^1^

References

1. Manage quarantined messages and files as an admin
2. Deletes all quarantined messages in the cloud-based Exchange organization by retrieving their identities and passing them to the Delete-QuarantineMessage cmdlet...