The question usually arrives as "can we just set it and forget it?" The honest answer for email security is: the filtering, yes; the watching, no. A modern filter on Microsoft 365 or Google Workspace, with or without a dedicated layer on top, runs on its own. What does not run on its own is the handful of decisions it leaves for a person each week: whether the quarantined invoice from a known supplier is real, whether to approve a release request, what to do about an alert that says someone's mailbox started forwarding to an outside address, and whether the message an employee reported was a phishing attempt that needs a password reset. This post lays out what a normal week looks like, what "set and forget" quietly misses, what a business-day review catches, and how to size the job for a company that has no IT person. The vendors' own words are used where the detail matters.
In short: the daily job is minutes, not hours, but it has four parts that do not do themselves: the quarantine, release requests, the alerts that are marked High or Medium, and the messages users report. The weekly job is one report and one look at the detections view. The monthly job is the settings review from the checklist and the mistakes posts. The evidence has a short life: a quarantined message is deleted after 15 days on a default Microsoft 365 tenant and 30 on Google Workspace, so a review that happens "when someone gets to it" happens after the message is gone. NIST frames detection as a continuous activity for a reason; the sizing question is who does the minutes, not whether they are needed.
What a normal week looks like
On the Microsoft side, the quarantine is where messages the filter judged as spam, phishing, malware or bulk wait for a decision. Users can receive quarantine notifications; Microsoft's quarantine policy settings offer "Within 4 hours, Daily, or Weekly" for the frequency. From the notification, "Review message" is "Available for all messages in quarantine notifications," "Release" is available where the policy grants Full access, and "Request release" where it grants Limited access. Some categories stay out of the user's hands: "Recipients can't release quarantined messages in the following scenarios, regardless of how the quarantine policy is configured: Messages quarantined as malware by anti-malware policies. Messages quarantined as malware or phishing by Safe Attachments policies. Messages quarantined as high confidence phishing by anti-spam policies." Those are the ones an admin, or whoever holds the admin role, has to look at.
On Google Workspace the admin quarantine is quieter: "Recipients are never notified when a message is quarantined," so unless an admin has turned on the periodic admin notification or opens the console, the message waits unseen. On Check Point's layer, end users get a digest: "The End User Quarantine Report (Digest) is an email notification sent to end users at least once per day," which "provides a summary of emails that were delivered to them that were either quarantined or moved to the Junk/Spam folder within the last 24 hours," sent "once per day at 12:00 AM (GMT +00:00)" by default. A user who wants a quarantined message back submits a restore request; Check Point's guide says "Administrators then need to decide whether to approve restore requests or not," and the user "will receive a notification that the request is sent to the administrator." So on a normal week, across any of the three, there is a small queue: a few quarantined messages worth a second look, a release or restore request or two, and the occasional alert.
What "set and forget" misses
The quarantine empties itself. Microsoft's retention for messages quarantined by anti-spam policies is "15 days" under "The default anti-spam policy" and "30 days" under the "Standard and Strict preset security policies"; anti-malware, Safe Attachments and mail flow rule quarantines hold "30 days." Then, "When messages expire from quarantine after the retention period, the messages are permanently deleted and can't be recovered." Google: "Quarantined messages are stored in quarantine up to 30 days after sending," and "Messages are automatically and permanently deleted after 30 days." A legitimate contract caught by a strict filter on the first of the month is gone on a default Microsoft tenant by the sixteenth; a targeted phishing attempt that should have prompted a password change is gone with it. (Check Point's own retention is longer: its data retention table lists "Quarantined emails (includes manually quarantined emails)" at "180 days," and "Email Security retains security events for 12 months," which matters when a question comes up in month three.)
Release requests sit. Under a Limited access policy, the user can only ask. If the requests go unread, the mail the user needs waits until the retention clock deletes it, and the user learns to ask the sender to resend to a personal address, which is the forwarding problem from the mistakes post arriving by another door.
Alerts marked High or Medium need a person the same day. Microsoft's alert policies carry severities, and two of the email ones are High: "Suspicious email forwarding activity," which "Generates an alert when someone in your organization has autoforwarded email to a suspicious external account," and "User restricted from sending email," which fires "when someone in your organization is restricted from sending outbound mail." Microsoft describes both as signs the account may be compromised, and for the forwarding one adds that "It's a good idea to check whether the user account is compromised." "Suspicious email sending patterns detected" is Medium, and warns that the user "is at risk of being restricted from sending email." Two Informational ones are worth reading anyway because they describe a rule a human made: "Creation of forwarding/redirect rule" and "Phish delivered due to an ETR override," which "Generates an alert when Microsoft detects an Exchange transport rule (also known as a mail flow rule) that allowed delivery of a high confidence phishing message to a mailbox." Google's alert center has its own named set for Gmail: "Phishing message detected post-delivery," "Malware message detected post-delivery," "Phishing in inboxes due to bad allowlist," "Gmail potential employee spoofing," "Suspicious message reported," "User-reported phishing," and "Spike in user reported spam," plus "Suspicious login blocked" and "Leaked password" under user alerts. An unread alert is a log entry.
Post-delivery is where the interesting events happen. Microsoft's zero-hour auto purge "retroactively detects and neutralizes malicious phishing, spam, or malware messages that were delivered to cloud mailboxes," and the alert "Email messages containing malicious URL removed after delivery" is the record of it. The companion alert matters more: "Messages containing malicious entity not removed after delivery," which fires when Microsoft "attempted to remove the infected messages from Exchange Online mailboxes using Zero-hour auto purge, but the message wasn't removed due to a failure." That one needs a person to go and find the message. Google's "detected post-delivery" alerts are the same idea.
User reports go somewhere, and someone has to be there. Microsoft's built-in Report button lets users "report false positives (good email that was blocked or sent to their Junk Email folder) and false negatives (unwanted email or phishing that was delivered to their Inbox)." Where the reports go is a setting: "Admins configure user reported messages to go to a specified reporting mailbox, to Microsoft, or both," and they appear "on the User reported tab on the Submissions page in the Microsoft Defender portal." Each report raises the alert "Email reported by user as malware or phish," rated Low; the automated investigation that follows is a Plan 2 feature: "For Defender for Office 365 Plan 2, E5, G5 customers, this alert automatically triggers automated investigation and response." On Business Premium, which carries Plan 1, the report is a signal for a person, not a trigger for automation. A report that goes unread teaches staff to stop reporting.
Settings drift. The allow list grows, the forwarding setting is changed for one person and left, a new tool starts sending as the domain. Little of this raises an alert on its own. It is the monthly review from the setup checklist and the ten mistakes, and it only happens if it is on a calendar.
What a business-day review catches
Daily, in the order that matters, and in minutes once the routine exists: open the alerts and clear the High and Medium ones first, since those include the compromised-mailbox signals; read the user reports, because a real phishing report can mean a password reset, not a filing; approve or decline the release and restore requests; then skim the quarantine for known senders caught by mistake, release those, submit the message to Microsoft from the Submissions page for analysis, and note to fix the sender's authentication rather than allow-listing a domain. On a quiet day the whole pass is five minutes. On the day it is not quiet, it is the day the review earns its keep.
Weekly, one report and one view. Check Point schedules its summary for you: "By default, the Security Checkup report is sent on every Sunday to all the administrators configured to receive it." On Microsoft, the view is Real-time detections on Plan 1 or Threat Explorer on Plan 2; Microsoft describes them as "near real-time reporting tools that help Security Operations (SecOps) teams investigate and respond to threats," with the difference that "Real-time detections show the malicious email detections at the time of delivery only. Threat Explorer shows all email detections at the time of delivery along with post-delivery activities." A weekly ten-minute look answers the question the daily pass does not: is something new targeting us, and who in the company is it aimed at.
Monthly, thirty minutes on the settings: MFA enrollment, admin count, the DMARC reports, the forwarding setting, the allow lists, the shared mailbox sign-in blocks, and the quarantine summary. That is the review from the checklist post, unchanged.
How to size the job
For a company of ten to fifty people, the arithmetic is roughly five minutes a day, ten a week, thirty a month: two to three hours a month, done by someone who has the admin role, knows what a release request is, and will open the console on the day an alert says High. NIST's Cybersecurity Framework puts detection in the continuous column: the Detect function is where "Possible cybersecurity attacks and compromises are found and analyzed," and its Continuous Monitoring category reads "Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events." The framework does not care who does the monitoring; it cares that it is continuous rather than occasional.
The reason it is worth two to three hours a month is in the FBI's numbers. The 2025 Internet Crime Complaint Center report states that "In 2025, losses reported to IC3 continued to climb, surpassing the $20 billion mark," on 1,008,597 complaints; its tables record business email compromise at 24,768 complaints and $3,046,598,558 in reported losses for the year. Business email compromise is the attack where a forwarding alert, a user report or a quarantined lookalike invoice is often the first sign, and on a set-and-forget tenant the sign can go unread until the wire has gone.
Three ways to staff it. First, a named person inside the company with the admin role, the daily five minutes on their calendar, and a written rule for what "High" means they do next. Second, the IT provider you already have, with the same four daily items written into the agreement rather than assumed. Third, a managed service that owns the queue on business days and reports monthly. The choice depends on who you have; the four daily items do not change.
How to start
If you would rather the business-day review were someone else's job, that is the managed half of Managed Email Security: the Check Point Advanced Protect license plus business-day quarantine review, release requests, investigation with no time cap, a monthly summary and 24/7 support, with a one-time SaaS security posture report of your Microsoft 365 or Google Workspace tenant within the first 90 days at no charge. It is $6.40 per user per month on the year-end offer ($5.60 for registered 501(c)(3) nonprofits; $8 list). The offer is 20% off (30% for registered 501(c)(3) nonprofits) on a 12-month Managed Email Security agreement signed by December 31, 2026, new customers only, no onboarding fee. If you already have an IT provider who will do the daily pass and only want the license, the license-only route explains how we beat a written quote, like for like. Either way, the free two-week email security assessment runs in Monitor only and ends with a report of what the two weeks' queue contained, which is the plainest answer to "how much monitoring do we need" for your mail. We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. Book a free 15-minute call or see the services page.
Sources: Microsoft Learn, Quarantined email messages in Microsoft 365 (updated 2026-07-17), Quarantine policies (2026-08-31), Quarantine notifications (2026-05-13), Alert policies in the Microsoft Defender portal (2026-08-03), Zero-hour auto purge (2026-06-01), About Threat Explorer and Real-time detections, Security Operations Guide for Defender for Office 365 (2026-07-03), Report phishing and suspicious emails in Outlook (2026-07-03); Google Workspace Admin Help, View alert details (2026-10-20) and Set up email quarantine; Check Point Harmony Email & Collaboration administration guide, Managing Quarantine, Requesting a Restore from Quarantine, End-User Daily Quarantine Report (Digest), Scheduling the Security Checkup Report, Data Retention Policy; NIST Cybersecurity Framework 2.0 (February 26, 2024), Detect function and DE.CM; FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Quotes are verbatim from those pages as read on October 22, 2026.
