How to Configure Admin Quarantine for Suspicious Emails in Google Workspace

The Second Line of Defense

Google Workspace possesses arguably the most sophisticated spam and phishing filters on the planet, powered by Google’s massive global machine learning infrastructure. However, no automated filter is perfect. Occasionally, a highly targeted spear-phishing email—perhaps pretending to be an invoice from a known vendor—will slip past the automated defenses because it does not contain a traditional virus payload.

To add an extra layer of security, system administrators can configure Admin Quarantine. Instead of delivering suspicious or policy-violating emails to a user’s spam folder (where the user might still mistakenly click a malicious link), a quarantine rule intercepts the email at the server level. The email is held in a secure vault where only the IT department can review it, approve it for delivery, or permanently destroy it.

Step 1: Creating the Quarantine Vault

Before you can route emails to a quarantine, you must configure the physical quarantine space.

1. Log into the Google Workspace Admin Console.
2. Navigate to Apps > Google Workspace > Gmail > Manage quarantines.
3. Click Add Quarantine.
4. Name the quarantine (e.g., Suspicious Invoices).
5. Rejection Consequence: If an IT admin reviews the email and clicks “Reject,” what happens? Choose to either drop the message silently or send a bounce notice back to the sender. Dropping it silently is generally safer for spam.
6. Click Save.

Step 2: Defining the Routing Rule

Now you must tell Google exactly which incoming emails should be diverted into this new vault. In this example, we will quarantine any email containing the word “Invoice” that contains an external attachment.

1. Navigate to Apps > Google Workspace > Gmail > Compliance.
2. Scroll down to the Content compliance section and click Configure.
3. Name the rule (e.g., Invoice Attachment Quarantine).
4. Under “Email messages to affect,” select Inbound.

Step 3: Setting the Triggers

You must now build the logical condition.

1. Under “Add expressions that describe the content you want to search for,” select If ANY of the following match the message.
2. Click Add. Select Advanced content match.
3. Set Location to Subject or body. Set Match type to Contains text. Type the word Invoice. Click Save.
4. Click Add again. Select Attachment content match. Configure it to match if the email possesses any attachment.

Step 4: Setting the Quarantine Action

Finally, you must link the trigger to the vault you created in Step 1.

1. Scroll down to the third section: “If the above expressions match, do the following.”
2. Instead of “Modify message” or “Reject message,” select Quarantine message.
3. A dropdown menu will appear. Select the Suspicious Invoices quarantine you created earlier.
4. Click Save at the bottom of the page.

Managing the Quarantine

When an email triggers this rule, the intended recipient will have no idea the email was sent. It simply will not arrive.

An IT Administrator must periodically check the quarantine by returning to the Manage quarantines page and clicking Go to quarantine. They will see a list of intercepted emails, which they can read safely without executing any malicious payloads. If the invoice is legitimate, the admin clicks Allow, and the email instantly drops into the user’s inbox as normal.