phish reported by users stuck in quarantine review queue

TL;DR

A stuck review queue is a workflow failure before it is a mail failure: submissions routed to a queue nobody owns, reviewer permissions missing, or a submissions mailbox that is full or unmonitored. Check the submissions configuration, who can review, and the age of the oldest items, then assign ownership and a daily clearance habit so reports are actioned while they still matter.

phish reported by users stuck in quarantine review queue

Use this when

• Quarantine or the submissions queue shows reported phish ageing for days.
• Users report phish and hear nothing back, so reporting is dropping.

Not for this skill when

• Reports never reach quarantine at all. That is a reporting or transport problem upstream.
• Items are reviewed promptly but releases keep failing. That is a release action problem.

Steps

1. Open the submissions view and record the count and age of unreviewed user reports. Verify: backlog size and oldest item age are known.
2. Check the user submission settings: where reports go, whether the reports mailbox is monitored, and whether reviewers hold the roles needed to review and release. Verify: routing and reviewer permissions are confirmed.
3. Triage the backlog by campaign: group identical reports, confirm one, and apply the verdict to the group. Verify: campaign grouping clears most volume quickly.
4. For confirmed phish in the backlog, run the tenant-wide purge for matching messages rather than handling copies one by one. Verify: delivered copies are removed, with the purge result recorded.
5. Set a named daily reviewer rotation and an ageing alert for items older than one business day. Verify: the rotation and alert exist and name real people.

Variant phrasings

user submissions quarantine backlog review defender

The Defender submissions variant.

reported phish no response review queue ageing

The workflow variant.

Compatibility: Microsoft 365 user submissions and quarantine in Defender, comparable triage queues in other gateways.

Why it happens

Reporting add-ins create a queue, but queues need staffing and permissions. The common failure is organisational: the queue was configured during deployment and its owner left, so reports collect silently.

Edge cases / pitfalls

• Close the loop with reporters. A short outcome note sustains reporting rates better than any training.
• Backlog age is a security metric: a campaign confirmed three days late has already done its damage.
• Keep evidence from one copy per campaign before purging the rest.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_J5itU81an4OfB5-qadzjOg