Use attachment-password rescanning instead of bypassing an encrypted-attachment quarantine

Source facts

For a quarantined Password protected item, Defender for Office 365 uses the supplied attachment password to rescan before release; it does not retain the password. A malicious attachment or one that remains unscannable stays quarantined for administrator review. Multiple protected attachments must share the same password. This release requires the portal rather than direct release from a notification email, and user release authority still depends on the quarantine policy. Microsoft Learn.

Applicability

This is the documented encrypted-attachment quarantine path, not a reason to approve an unexpected message. Microsoft warns users to provide only the attachment password, never unrelated account credentials, and to escalate unexpected protected messages. Microsoft Learn.

DSE recommendation

Have the recipient validate an expected sender and use only the attachment password in the documented portal workflow. Prepare help-desk guidance that distinguishes an attachment secret from a sign-in credential. Do not instruct users to work around the quarantine or treat possession of a password as proof that the file is harmless. Route unavailable release actions or unsuccessful rescans to the authorized mail-security reviewer.

Verification

Use an approved benign protected attachment to rehearse the recipient experience where policy permits it. Record the quarantine reason, available action and resulting status without recording the password. Confirm the support instructions send the recipient to the portal and preserve administrator review when scanning cannot complete. State the observed outcome accurately rather than promising release simply because a password was entered.

Official references

Microsoft Learn: User quarantine management. Source reviewed September 9, 2026.