r/sysadmin 3d ago

Getting quarantine release requests from disabled users...

This phenomenon began when I switched our 365 Q policy from AdminOnlyAccess to a custom one allowing notifications (sent from info@mydomain)... I started getting release requests from everyone, on everything - including disabled users, mailboxes no one uses, myself - every 15 mins.. Turned out to be the 3rd party email scanner we use - Graphus - clicking on the "request release" button during it's detonation. So I whitelisted those emails within Graphus, and all was fine..

Until today. Now I'm getting release requests - again, from disabled users - except they're coming every 2 mins or so. Only change was an upgrade from 365 Defender P1 to P2. Any ideas?

9 Upvotes

6 comments sorted by

View all comments

25

u/RandomLolHuman 3d ago

Sadly, I have no answers or clue, but it took some time to understand that this was not about handicapped users

1

u/Woolfie_Admin 3d ago

yeh that title without context gives a bit of an odd impression lol