Skip to main content
Microsoft Quarantine Release extends Ocean’s release request workflow to emails quarantined by Microsoft 365. When an employee requests release, Ocean AI Agents analyzes the email, makes a release decision based on your configured policy, and notifies the employee of the outcome.
This feature requires:
  1. DNS Setup to be completed so Ocean can send emails from your corporate domain
  2. Microsoft M365 Quarantine Release Integration to grant Ocean access to your Microsoft 365 quarantine
For release requests on emails quarantined by Ocean, see Ocean Quarantine Release.

​
How It Works

When an employee requests release of a Microsoft 365-quarantined email:
1

Ocean analyzes the email

using AI agents to determine if it’s safe, spam, or malicious
2

Ocean analyzes the email using AI to determine if it's safe, spam, or malicious

3

For safe emails — Ocean automatically releases the email to the employee's inbox

4

For spam emails — behavior depends on the Release confirmed spam toggle

Ocean either releases the email or keeps it quarantined and notifies the employee
5

For malicious emails — Ocean keeps the email quarantined and sends the employee a detailed explanation of why it cannot be released

Unlike Ocean-quarantined emails, Microsoft 365-quarantined emails do not generate a daily digest. Employees submit release requests directly through Microsoft’s native quarantine interface, and Ocean handles the review and response.

​
Request Handling

VerdictWhat happens
SafeThe email is automatically released to the employee’s inbox. No notification is sent.
SpamDepends on the Release confirmed spam toggle — released automatically or kept quarantined with an explanation.
MaliciousThe email remains quarantined. The employee receives a notification with AI-generated reasoning about the threat.

​
Configuration

Navigate to Settings → AI Response → Quarantine release in the Ocean portal.
Until DNS setup is complete, notifications are sent from soc-automation@ocean.security. After setup, responses will come from your corporate domain.

​
Enable Microsoft Quarantine Release

Toggle Microsoft quarantine release to enable release requests and request handling for emails quarantined by Microsoft.
Before enabling this toggle, make sure the Microsoft 365 integration is configured. See Microsoft M365 Quarantine Release Integration for setup instructions.

​
Release Confirmed Spam

Toggle Release confirmed spam to control how Ocean handles emails classified as spam when an employee requests release:
SettingWhat happens
OnSpam emails are automatically released to the employee’s inbox. No notification is sent.
OffSpam emails remain quarantined and the employee receives an explanation.

​
Release Scope

Who can use quarantine release controls which employees can have their quarantine requests processed:
OptionDescription
NoneNo release requests are processed. All quarantine requests require manual review.
Specific employeesOnly process requests from designated users or groups.
All employeesProcess release requests from anyone in the organization.
When Specific employees is selected, two additional fields appear:
FieldDescription
Eligible usersIndividual email addresses whose requests will be processed
Eligible groupsDistribution groups or security groups whose members’ requests will be processed

​
Sender Settings

Customize the sender identity used for employee notifications:
FieldDescription
Sender nameDisplay name shown in the From field (e.g., “Ocean Security”)
Sender mailboxEmail address used to send notifications. Changing to a different domain requires DNS setup.
When you change the sender mailbox to a different domain, the change is pending until DNS verification is complete. Until then, notifications continue to send from the default address.