I could not find any specific API to fetch and modify Quarantine emails (https://security.microsoft.com). I have explored the following methods to interact with quarantine emails and have a couple of questions:
Advanced hunting APIs
We can use the Advanced hunting API to search for quarantine emails, but there doesn’t seem to be a way to release them or add emails to quarantine via the API. Am I correct?
Questions:
- Microsoft Defender (https://security.microsoft.com) is an add-on subscription and does not come with every Microsoft Office 365 subscription. Am I correct?
- Could you please confirm which subscription includes the following features?
- Microsoft Defender for Office 365 Plan 1
- Advanced Hunting Portal
- Policies and Rules (Quarantine Policies and Policies: Anti-Phishing, Anti-Spam, Anti-Malware, Safe Attachments, Safe Links)
- Microsoft Defender for Office 365 Plan 2
- Advanced Hunting Portal
- Threat Explorer
- Policies and Rules (Quarantine Policies and Policies: Anti-Phishing, Anti-Spam, Anti-Malware, Safe Attachments, Safe Links)
- Does only the EOP plan exist (https://security.microsoft.com)?
Exchange Online PowerShell
We can use Exchange Online PowerShell cmdlets to fetch quarantine emails, but it appears that admin authentication is required at runtime.
Question:
- Is there a way to use Exchange Online PowerShell quarantine cmdlets with application permissions instead of requiring admin credentials every time? This is important because we want to process quarantine emails as a background job.
Threat Explorer
We can use the Threat Explorer portal to view quarantine emails.
Question:
- Is there a Microsoft Graph API available for the Threat Explorer portal? I couldn’t find one.
Do any APIs exist that I have not encountered to fetch and modify quarantine emails?
Please correct me if I am mistaken, as other users may have the same understanding and similar questions.
Thank you