attachment download failed when agent tried to pull the eml from the quarantine API

TL;DR

Listing and downloading are separate permissions and separate endpoints in most quarantine APIs, so an agent can see a message it cannot fetch. Failures also come from identifier confusion: the quarantine id, the message id and the internet message id are three different keys, and only one opens the download. Confirm which identifier the download call wants, check the agent role includes message retrieval, and handle the API habit of returning the eml as an encoded payload rather than a file.

attachment download failed when agent tried to pull the eml from the quarantine API

Use this when

• The agent lists quarantined items but every eml download errors.
• Downloads work for some tenants or mailboxes and fail for others under the same agent.

Not for this skill when

• The item was already released or expired from quarantine. Its download legitimately fails; check retention first.
• The agent cannot list quarantine either. That is a broader access problem.

Steps

1. Capture the exact API error for a download attempt on a current item, with the identifier sent. Verify: the error and the identifier type are recorded.
2. Read the API documentation for the download operation and confirm the required identifier and role. Verify: the agent request matches the documented contract.
3. Check the agent role assignment includes quarantine message retrieval, not only queue viewing. Verify: the permission gap, if any, is closed.
4. Handle the response format correctly, decoding the returned payload to a file and validating it parses as a message. Verify: a downloaded eml opens in the analysis step.
5. Download every item in a test campaign set through the agent. Verify: all succeed, or failures are item-specific with reasons logged.

Variant phrasings

quarantine api download eml fails identifier permission

The identifier variant.

agent fetch original message quarantine retrieval role

The retrieval role variant.

Compatibility: Defender and gateway quarantine APIs, Exchange message retrieval operations.

Why it happens

Quarantine systems separate seeing from touching for good reason: the raw message is the dangerous artefact. Agents built against the friendly list view discover the stricter contract only when they reach for the evidence itself.

Edge cases / pitfalls

• Downloaded eml files are live evidence and potentially live malware. Store them in the restricted attachment store, not working folders.
• Quarantine retention is short. Download evidence at first triage, not at report time.
• Record the quarantine id alongside the file; correlating them later without it is painful.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TahogXupqmUgn3lo3pA6zg