Email Security

The Email Security Action Summary is an automated daily email sent around 11:00 AM PT. It summarizes email security actions taken in the past 24 hours, such as emails being held or links/attachments being locked. You can open the message and select “More info” to understand what happened and why.

Emails can be previewed for up to 3 days. After that, previews are no longer available. Emails older than 21 days cannot be released, and release requests are not accepted.

Actions:

· Email was held- The email has been quarantined.

· Email moved to Junk- The email is located in your Junk Email folder and can be moved back without a release request.

· Lock Link- One or more links in the email have been locked.

· Strip Attachment- The attachment has been removed or converted for safety.

Stop and verify: If a message looks like phishing, do not click links or open attachments.

· Inbox Analysis (recommended):
Submit the email using Inbox Analysis for the safest and most detailed review. After reviewing the results, mark the message as Safe, Junk, or Suspicious so protections improve over time.

· Outlook Report (backup option):
Use Outlook’s built-in Report feature if Inbox Analysis isn’t available or if you are highly confident the message is phishing or spam.

· Security Team review:
Forward the message to [email protected] if you need a security review.

It’s possible. If email security acted, you may receive a daily “Email Security Action Summary” from [email protected], or a quarantine notification from [email protected]. These notifications explain what action was taken and why.

Start by checking for security notifications, such as the daily “Email Security Action Summary” from [email protected], or a quarantine notification from [email protected], as the message may have been held or quarantined for safety. Next, check your Junk Email and Deleted Items folders.
If the message is still missing, it may have been blocked as a high-confidence threat. In that case, submit a Security Team review request through the portal for further investigation.

If an email contains something that appears suspicious or risky, email security may lock a link or attachment to protect you from malware or phishing.

This does not always mean the content is malicious. Occasionally, legitimate messages may be flagged. User feedback helps train the AI system, and as the system matures, the false-positive rate continues to decrease.

Inbox Analysis is an on-demand, AI-based security tool that evaluates an email and explain, using plain language, why it appears safe or risky.

It also allows you to provide feedback by marking a message as Safe, Junk, or Suspicious, which helps improve email security protections over time.

When a release option is available through the Action Summary workflow, you can submit a release request and include a brief explanation of why you were expected the email. The MCCD security team reviews the request before taking action.

Messages actioned by Microsoft are placed in Microsoft Quarantine, and you may receive a notification from [email protected]. In many cases, you can safely preview the message and release it yourself if you’re confident it’s legitimate. If you’re unsure, request a review instead of releasing the message.

If you’re not sure whether an email is safe, submit the email through Inbox Analysis for the most thorough review. After reviewing the results, mark the message as Safe, Junk, or Suspicious. You can also forward the email to [email protected] for review by the MCCD Security Team.