ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 272/272 feeds/APIs · 469/469 docs · 7/9 advisories · checked 14:23 UTC Customize Public modeDiscuss ChangeIntel on Discord
MC1166867 Stay informedUpdated messageFeature updateUser impactAdmin impact

Microsoft Defender for Office 365: Enhancing the quarantine email preview experience

From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Microsoft Defender XDR
Microsoft 365 admin center

Rollout

Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions this installation saw
  • Seen 23 Oct 2025 mid-October 2025, late October 2025 → mid-December 2025

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, safely structured

Updated February 18, 2026: We have updated the content. Thank you for your patience.

We’re improving the email preview experience in Microsoft Defender for Office 365 to provide a clearer, more consistent, and secure workflow. These updates are designed to reduce ambiguity, simplify interactions, and reinforce security protections—helping organizations confidently use this feature as part of their protection strategy.

When this will happen

General Availability (Worldwide): Rollout will begin in early November 2025 (previously mid-October) and is expected to complete by mid-December 2025 (previously early November).

General Availability (GCC, GCCH, and DoD): Rollout will begin in mid-November 2025 (previously late October) and is expected to complete by mid-December 2025 (previously mid-November).

How this affects your organization

Who is affected: Quarantine users Microsoft Defender for Office 365 with access to review and preview messages within quarantine.

The update is specifically for the preview capability within the quarantine experience. What will happen:

  • The update consists of three main parts:
    • Streamlined view options: The plain text view option will be retired for users to unify preview behaviors across Defender experiences. It will still be present for admins.
    • Clearer handling of URLs: The hover-over preview for URLs will be limited for users to reinforce that links in quarantine preview are not clickable.
    • Simplified content loading: The “Load external content” button will be removed for some scenarios. Content will render in a secure, isolated environment.

Quarantine users will experience a simplified preview interface with clearer rendering and reduced visual cues for URL interactivity:

What you can do to prepare

  • Update any internal documentation that references the quarantine preview experience.
  • Communicate these changes to helpdesk and support teams to reduce confusion.
  • No configuration changes are required; the update will apply automatically.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

What changed

Between archive captures, newest first

  1. Updated October 23, 2025:February 18, 2026: We have updated the timelines.content. Thank you for your patience.  We’re improving the email preview experience in … 2025 (previously mid-November). How this affects your organization: Who is affected: Quarantine administratorsusers Microsoft Defender for Office 365 as well as users with access to review and preview messages within quarantine. The update is … main parts:Streamlined view options: The plain text view option will be retired for users to unify preview behaviors across Defender experiences. It will still be present for admins. Clearer handling of URLs: The hover-over preview for URLs will be limited for users to reinforce that links in quarantine preview are not clickable. Simplified content loading:  The “Load external content” button will be removed for some scenarios. Content will render in a secure, isolated environment. Quarantine administrators and users will experience a simplified preview interface with clearer rendering and reduced …

    • Tags Feature update, User impact, Admin impact → Updated message, Feature update, User impact, Admin impact

    Updated October 23, 2025: We have updated the timelines. Thank you for your patience.  We’re improving the email preview experience in Microsoft Defender for Office 365 … strategy. When this will happen: General Availability (Worldwide): Rollout will begin in mid-Octoberearly November 2025 (previously mid-October) and is expected to complete by mid-December 2025 (previously early November 2025. November). General Availability (GCC, GCCH, and DoD): Rollout will begin in mid-November 2025 (previously late October 2025 October) and is expected to complete by mid-November 2025.mid-December 2025 (previously mid-November). How this affects your organization: Who is affected: Quarantine administrators Microsoft Defender …

  3. · first version seen

Learn more

Links from the notice and their documentation checks

No related evidence found in this installation's recent collection. This does not establish that no announcement exists.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 27 Oct 14:23 UTC · 272 of 272 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.