You can use the Quarantine view to locate Exchange Online messages, OneDrive and SharePoint Online files placed in Kaspersky Security for Microsoft Office 365 Quarantine and/or Exchange Online Quarantine, review their details, and decide whether a message or file will be permanently deleted, released to user or site, or saved to disk for further internal inspection or other purposes.
The quarantined items are listed according to their detection date: the newest items are displayed at the top of the list. By default, the list of quarantined items is arranged by 10 lines per page. You can switch the pages of the list back and forth or change the default number of displayed lines per page at the bottom of the page.
For detections made by Kaspersky Security for Microsoft Office 365:
Malware
Phishing
Filtered attachment
Spam
Mass mail
Denylist
Data Discovery
Statuses assigned to items by Kaspersky Security for Microsoft Office 365 are marked by the icon.
For detections made by Exchange Online:
Bulk mail
Phishing
Spam
Mail flow rule match
Malware
Statuses assigned to items by Exchange Online are marked by the icon.
Messages cannot be moved to Quarantine by the Anti-Spam module. The Spam or Mass mail status is displayed in the table of quarantined items only if it was assigned to the message together with the Phishing, Malware, or Filtered attachment status.
General quantity of confidential data within an item detected by the Data Discovery module. For all detections made by the protection modules the 0 value is displayed.
Depending on the service where the item was detected, this column displays name of the protected Exchange Online mailbox, name of the protected OneDrive user, or name of the user that uploaded the detected item to the protected SharePoint Online site.
Quarantine storage type. The quarantined items can be stored by Kaspersky Security (the icon is displayed), Exchange Online (the icon is displayed) or Temporary Quarantine (the icon is displayed).
Email address of the administrator who released the quarantined item.
If you want to display a specific message or file details only, click the Columns button on the right side of the page and select the required columns.
If you want to refresh Kaspersky Security for Microsoft Office 365 Quarantine data, reload the corresponding Management Console web page in your browser.
The new Exchange Online Quarantine data is automatically requested by the application every two hours. In urgent cases, you can force the application to retrieve new messages from Exchange Online Quarantine by clicking the Load items button on the right side of the page.
Records about messages and files released from Quarantine remain in the table of quarantined items. They become inactive (grayed out) and have the Released status prefix. You can only delete them from the table manually.
If you refresh the Quarantine data, all check boxes next to the quarantined items in the list will be cleared.
icon. 
icon.