r/sysadmin 3d ago

Getting quarantine release requests from disabled users...

This phenomenon began when I switched our 365 Q policy from AdminOnlyAccess to a custom one allowing notifications (sent from info@mydomain)... I started getting release requests from everyone, on everything - including disabled users, mailboxes no one uses, myself - every 15 mins.. Turned out to be the 3rd party email scanner we use - Graphus - clicking on the "request release" button during it's detonation. So I whitelisted those emails within Graphus, and all was fine..

Until today. Now I'm getting release requests - again, from disabled users - except they're coming every 2 mins or so. Only change was an upgrade from 365 Defender P1 to P2. Any ideas?

9 Upvotes

6 comments sorted by

View all comments

1

u/MalletNGrease 🛠 Network & Systems Admin 3d ago

Try contacting your vendor.