"This issue may block some users from receiving email messages due to their mailboxes incorrectly being quarantined, and users sending email to these mailboxes may receive a Non-delivery Report (NDR)," Microsoft said.
Microsoft incident EX1436407: timing and immediate impact
Microsoft is tracking these interruptions under incident EX1436407. The company says the problem began on July 19 and, as of the most recent update Wednesday evening, remained unresolved. During the event, affected Exchange Online users have reported being unable to receive or send email and experiencing problems accessing their calendars.
Cause identified: an infrastructure change and excess indexing data
Microsoft has attributed the quarantines to a recent infrastructure change that produced unexpected indexing data and excessive memory consumption. In Microsoft's words, that led to "an out-of-memory condition, causing affected mailboxes to be incorrectly quarantined." The company framed the quarantines as the product of a resource exhaustion event, not as an intended security action.
Mitigation steps and progress metrics reported
To remediate the condition, Microsoft is performing an ongoing cleanup of the excess indexing data and removing mailboxes from quarantine as memory usage is validated across regions. The company reported measurable progress: the cleanup advanced from 66% complete as of Wednesday afternoon to 72% complete by Wednesday evening. As portions of the indexing data are removed and memory levels validated, mailboxes are being taken out of quarantine to expedite recovery.
Microsoft has not provided a firm completion timeline for full remediation. The company said only that it would provide a completion timeline in a future update and scheduled its next status update for later today at 6 p.m. UTC.
Prior Exchange Online quarantines Microsoft has mitigated
Microsoft noted that this event fits a pattern of past incidents in which legitimate messages or URLs were inadvertently quarantined or flagged. The company pointed to an Exchange Online bug in March 2025 that caused anti-spam systems to mistakenly quarantine some users' emails, and to a May 2025 issue where a machine learning model incorrectly flagged emails from Gmail accounts as spam. More recently, in September, an anti-spam service issue blocked Exchange Online and Microsoft Teams users from opening URLs and mistakenly quarantined their emails. Microsoft also addressed an Exchange Online problem in February when faulty heuristic detection rules designed to block credential phishing campaigns incorrectly flagged thousands of legitimate URLs as phishing links.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Will monitor the cleanup percentages and memory-validation steps Microsoft is reporting, and may need to verify mail flow and calendar access for critical accounts as quarantines are lifted.
- Affected enterprises and procurement leaders: Should track Microsoft's scheduled updates—next one at 6 p.m. UTC—and prepare to validate that quarantined mailboxes return to normal before declaring full recovery or resuming disrupted workflows.
- End users: May encounter Non-delivery Reports (NDRs) when sending to quarantined mailboxes until Microsoft completes its remediation and confirms normal memory levels in impacted regions.
Microsoft's immediate, measurable progress—moving from 66% to 72% cleanup within hours—offers a concrete signal that the company is actively addressing the underlying indexing-data condition. But Microsoft has not yet committed to a completion time and has said it will issue a remediation timeline in a future update. The next public checkpoint is the company's scheduled update at 6 p.m. UTC.
Read the original Microsoft incident notice at BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-working-to-fix-exchange-online-mailbox-quarantine-issue/
