We're piloting a workflow where users can request the release of quarantined messages, with plans to eventually allow user self-release. During the transition, we want administrative visibility so suspicious messages aren't released without oversight. Is there a way to send an immediate notification to an IT administrator group whenever a quarantined message is released, whether by a user or an administrator? Also, can the released message itself automatically be forwarded, BCC'd, or routed to a monitoring mailbox for inspection without requiring IT to obtain it from the end user?
3 Answers
I’d monitor quarantine-release events rather than automatically forwarding the released message. Alerts can include the user, sender, recipient, subject or message identifiers, and release details so IT can investigate suspicious activity. Copying the payload creates another potentially dangerous copy of the same content and may increase the risk.
Keep administrative approval enabled for all release requests. The user can submit the request, while the IT distribution list or shared mailbox receives it for review and final release. That provides oversight without allowing users to release potentially malicious messages directly.
User self-release remains a significant risk even after the pilot. If the goal is dependable protection, require administrator approval for every release and route those requests to a controlled IT mailbox or approval group.
That makes sense, but I was hoping to find a way to add monitoring or alerts without making IT manually chase every release. Do you know whether release events can be surfaced automatically?