{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/google-workspace-quarantine-reviewer-notification-retention/", "item": { "id": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/", "slug": "google-workspace-quarantine-reviewer-notification-retention", "url": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention.md", "json": "https://update.dsesecurity.com/api/v1/posts/google-workspace-quarantine-reviewer-notification-retention/" }, "title": "Assign a real review process for Google email quarantine instead of relying on notifications", "summary": "Quarantine reviewers and notification recipients are not necessarily the same people.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "microsoft-365-identity", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:34:00+00:00", "modified_at": "2026-10-15T13:36:18+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 274, "potentially_affected": "This concerns Google Workspace email quarantine and its built-in notifications. Separate retention services such as Vault have their own configuration and should not be assumed to provide the same reviewer workflow.", "dse_recommendation": "DSE recommends naming the daily reviewers, backup reviewers, and escalation owner explicitly.", "primary_source": { "name": "Google — Email quarantine", "url": "https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine?hl=en", "published_on": null, "authority": "knowledge.workspace.google.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Quarantine reviewers and notification recipients are not necessarily the same people.

\n

Source facts

\n

Google Workspace quarantine holds matched messages for review before delivery. Administrators can create restricted quarantines and assign reviewer groups, but the documented periodic notification feature sends its notices only to super administrators, not to reviewer groups or users with quarantine privileges. Recipients are not notified that a message is quarantined. Unacted-on messages are permanently deleted from quarantine after 30 days. If a custom quarantine is deleted while holding messages, its messages move to the default quarantine; references from rules must be addressed before deleting the quarantine.

\n

Source: Google — Email quarantine.

\n

Applicability

\n

This concerns Google Workspace email quarantine and its built-in notifications. Separate retention services such as Vault have their own configuration and should not be assumed to provide the same reviewer workflow.

\n

DSE recommendation

\n

DSE recommends naming the daily reviewers, backup reviewers, and escalation owner explicitly. Establish a review cadence and approved evidence handling so missed notification emails do not allow messages to age out unnoticed. Explain to staff how to report a missing message without assuming the recipient will receive a quarantine notice. Before changing or retiring a quarantine, review its referencing rules and outstanding messages. Keep release and rejection decisions attributable, and ensure the review process respects the sensitivity of the held message content.

\n

Verification

\n

Use a harmless test rule and message to confirm the intended quarantine and reviewer access. Check which identities receive periodic notices and whether the recipient receives none. Review the pending-message age and rule references before retiring the test quarantine, then remove the test settings through the approved process.

\n

Official reference

\n

Google — Email quarantine. Reviewed October 15, 2026.

", "content_text": "Quarantine reviewers and notification recipients are not necessarily the same people.\nSource facts\nGoogle Workspace quarantine holds matched messages for review before delivery. Administrators can create restricted quarantines and assign reviewer groups, but the documented periodic notification feature sends its notices only to super administrators, not to reviewer groups or users with quarantine privileges. Recipients are not notified that a message is quarantined. Unacted-on messages are permanently deleted from quarantine after 30 days. If a custom quarantine is deleted while holding messages, its messages move to the default quarantine; references from rules must be addressed before deleting the quarantine.\nSource: Google — Email quarantine.\nApplicability\nThis concerns Google Workspace email quarantine and its built-in notifications. Separate retention services such as Vault have their own configuration and should not be assumed to provide the same reviewer workflow.\nDSE recommendation\nDSE recommends naming the daily reviewers, backup reviewers, and escalation owner explicitly. Establish a review cadence and approved evidence handling so missed notification emails do not allow messages to age out unnoticed. Explain to staff how to report a missing message without assuming the recipient will receive a quarantine notice. Before changing or retiring a quarantine, review its referencing rules and outstanding messages. Keep release and rejection decisions attributable, and ensure the review process respects the sensitivity of the held message content.\nVerification\nUse a harmless test rule and message to confirm the intended quarantine and reviewer access. Check which identities receive periodic notices and whether the recipient receives none. Review the pending-message age and rule references before retiring the test quarantine, then remove the test settings through the approved process.\nOfficial reference\nGoogle — Email quarantine. Reviewed October 15, 2026.", "content_markdown": "Quarantine reviewers and notification recipients are not necessarily the same people.\n\n## Source facts\n\nGoogle Workspace quarantine holds matched messages for review before delivery. Administrators can create restricted quarantines and assign reviewer groups, but the documented periodic notification feature sends its notices only to super administrators, not to reviewer groups or users with quarantine privileges. Recipients are not notified that a message is quarantined. Unacted-on messages are permanently deleted from quarantine after 30 days. If a custom quarantine is deleted while holding messages, its messages move to the default quarantine; references from rules must be addressed before deleting the quarantine.\n\nSource: [Google — Email quarantine](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine?hl=en).\n\n## Applicability\n\nThis concerns Google Workspace email quarantine and its built-in notifications. Separate retention services such as Vault have their own configuration and should not be assumed to provide the same reviewer workflow.\n\n## DSE recommendation\n\nDSE recommends naming the daily reviewers, backup reviewers, and escalation owner explicitly. Establish a review cadence and approved evidence handling so missed notification emails do not allow messages to age out unnoticed. Explain to staff how to report a missing message without assuming the recipient will receive a quarantine notice. Before changing or retiring a quarantine, review its referencing rules and outstanding messages. Keep release and rejection decisions attributable, and ensure the review process respects the sensitivity of the held message content.\n\n## Verification\n\nUse a harmless test rule and message to confirm the intended quarantine and reviewer access. Check which identities receive periodic notices and whether the recipient receives none. Review the pending-message age and rule references before retiring the test quarantine, then remove the test settings through the approved process.\n\n## Official reference\n\n[Google — Email quarantine](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine?hl=en). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/", "url": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Assign a real review process for Google email quarantine instead of relying on notifications", "item": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/#article", "identifier": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/", "url": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/", "headline": "Assign a real review process for Google email quarantine instead of relying on notifications", "description": "Quarantine reviewers and notification recipients are not necessarily the same people.", "abstract": "Quarantine reviewers and notification recipients are not necessarily the same people.", "articleBody": "Quarantine reviewers and notification recipients are not necessarily the same people.\nSource facts\nGoogle Workspace quarantine holds matched messages for review before delivery. Administrators can create restricted quarantines and assign reviewer groups, but the documented periodic notification feature sends its notices only to super administrators, not to reviewer groups or users with quarantine privileges. Recipients are not notified that a message is quarantined. Unacted-on messages are permanently deleted from quarantine after 30 days. If a custom quarantine is deleted while holding messages, its messages move to the default quarantine; references from rules must be addressed before deleting the quarantine.\nSource: Google — Email quarantine.\nApplicability\nThis concerns Google Workspace email quarantine and its built-in notifications. Separate retention services such as Vault have their own configuration and should not be assumed to provide the same reviewer workflow.\nDSE recommendation\nDSE recommends naming the daily reviewers, backup reviewers, and escalation owner explicitly. Establish a review cadence and approved evidence handling so missed notification emails do not allow messages to age out unnoticed. Explain to staff how to report a missing message without assuming the recipient will receive a quarantine notice. Before changing or retiring a quarantine, review its referencing rules and outstanding messages. Keep release and rejection decisions attributable, and ensure the review process respects the sensitivity of the held message content.\nVerification\nUse a harmless test rule and message to confirm the intended quarantine and reviewer access. Check which identities receive periodic notices and whether the recipient receives none. Review the pending-message age and rule references before retiring the test quarantine, then remove the test settings through the approved process.\nOfficial reference\nGoogle — Email quarantine. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:34:00+00:00", "dateModified": "2026-10-15T13:36:18+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/google-workspace-quarantine-reviewer-notification-retention/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Assign a real review process for Google email quarantine instead of relying on notifications" }, "articleSection": [ "Cybersecurity", "Microsoft 365 & Identity" ], "keywords": [ "Cybersecurity", "Microsoft 365 & Identity", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" } ], "wordCount": 274, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Google — Email quarantine", "url": "https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine?hl=en" } } ] } }