## TL;DR
A stuck review queue is a workflow failure before it is a mail failure: submissions routed to a queue nobody owns, reviewer permissions missing, or a submissions mailbox that is full or unmonitored. Check the submissions configuration, who can review, and the age of the oldest items, then assign ownership and a daily clearance habit so reports are actioned while they still matter.

```text
phish reported by users stuck in quarantine review queue
```

## Use this when
- Quarantine or the submissions queue shows reported phish ageing for days.
- Users report phish and hear nothing back, so reporting is dropping.

## Not for this skill when
- Reports never reach quarantine at all. That is a reporting or transport problem upstream.
- Items are reviewed promptly but releases keep failing. That is a release action problem.

## Steps
1. Open the submissions view and record the count and age of unreviewed user reports. Verify: backlog size and oldest item age are known.
2. Check the user submission settings: where reports go, whether the reports mailbox is monitored, and whether reviewers hold the roles needed to review and release. Verify: routing and reviewer permissions are confirmed.
3. Triage the backlog by campaign: group identical reports, confirm one, and apply the verdict to the group. Verify: campaign grouping clears most volume quickly.
4. For confirmed phish in the backlog, run the tenant-wide purge for matching messages rather than handling copies one by one. Verify: delivered copies are removed, with the purge result recorded.
5. Set a named daily reviewer rotation and an ageing alert for items older than one business day. Verify: the rotation and alert exist and name real people.

## Variant phrasings
### user submissions quarantine backlog review defender
The Defender submissions variant.
### reported phish no response review queue ageing
The workflow variant.

Compatibility: Microsoft 365 user submissions and quarantine in Defender, comparable triage queues in other gateways.

## Why it happens
Reporting add-ins create a queue, but queues need staffing and permissions. The common failure is organisational: the queue was configured during deployment and its owner left, so reports collect silently.

## Edge cases / pitfalls
- Close the loop with reporters. A short outcome note sustains reporting rates better than any training.
- Backlog age is a security metric: a campaign confirmed three days late has already done its damage.
- Keep evidence from one copy per campaign before purging the rest.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_J5itU81an4OfB5-qadzjOg