Hi,
In an ESA / SMA deployment, I have a Incoming Mail Policy where I have 1 content filter applied and also Outbreak Filter enabled (with default retention of 1h)
Can you confirm the behaviour when the VOF detects an email, quarantine it and releae ...