In App Access Control policies, the Quarantine Copy secondary action makes a copy of any email containing violating content in the subject line, message body, or attachments. The violating content can then be reviewed. Selecting the Quarantine Copy action does not automatically prevent access to the email - for example, in the policy you can choose Allow & Log as the primary action and still choose Quarantine Copy as a secondary action. This action places a copy of the message in the Forensic Copy page.

Notes:

• Email messages listed in the Forensic Copy page are copies only.
• The Quarantine Copy action is applied only once per email, even if there are multiple violations in different parts of the content.

• Any recipient names in the bcc line of an email are not captured in the copy placed in quarantine. Only recipient names in the cc line are included.

  Once a copy of an email message is reviewed, it can be deleted. Because it is a copy, there is no

  Restore remediation action.