Case 02 · Microsoft 365 and human judgement
866 quarantined emails. Three decisions.
The business did not need another dashboard showing that the quarantine queue was large. It needed the queue reduced to the messages that actually required judgement.
OutcomeAutomation handled the volume while a person retained control of the consequential decisions.
Dramatised with a synthetic consultant. Based on anonymised Blue Hybrid delivery records. No client, customer or employee is depicted.
Evidence ledger
What the record supports.
Every figure is labelled by what it represents.
Measured
866held messages in the review population
The starting quarantine population.
Recorded
193partner domains used as business context
A known domain was context, never proof of safety.
Measured
3items requiring immediate human judgement
99.65% left the immediate decision queue. That does not mean it was declared safe or deleted.
The visible request
A queue too large to review casually and too risky to release quickly.
The queue mixed spam, bulk email, phishing, high-confidence phishing, malware, release requests, known suppliers and unknown senders. Some messages looked familiar because an attacker wanted them to.
Reviewing everything manually would take time. Releasing too quickly created risk. Leaving everything blocked could delay genuine commercial work.
The system
We gave the audit business context.
Blue Hybrid built an automated Microsoft 365 quarantine-audit pipeline. It checked the current quarantine state against a reference of 193 partner domains, separated routine noise from release requests, highlighted unusual patterns, recorded the result in Jira and produced recommended actions.
A known supplier domain was useful context. It was not proof that a message was safe.
You make the call
A familiar domain appears. Is that enough?
This is an illustrative decision, not a reproduced client message. The only signal shown is one the real pipeline used: the sender domain appears in a reference of 193 partner domains.
No message content, relationship confirmation or risk acceptance is shown.
Static outcome. The recorded recommendation remains available without scripting.
The recorded pipeline treated a familiar domain as business context, never proof of safety. Its three-item queue existed so a person could decide whether each item was genuinely expected, supported by the business relationship and within acceptable risk.
The result
Hundreds of messages became three questions.
From 866 held messages, only three required immediate human judgement. That removed 99.65% of the review population from the immediate decision queue without claiming those messages were safe or deleted.
- Is this genuinely expected?
- Does the business relationship support the request?
- Is the risk acceptable?
Human control
Automation did not replace judgement.
The pipeline created a record of what was found, what was recommended and what still needed a person. It handled the scale so the reviewer could focus on the decisions where context and consequence mattered.
Automation handled the volume. A human kept control of the consequential calls.
Why it mattered
The customer was protected from two opposite failures.
One failure was releasing dangerous content because the sender looked familiar. The other was blocking important communication because nobody had enough time to review it properly.
The system made judgement possible and left an accountable record of every recommendation.
Film transcript
Read the documentary narration.
Make judgement possible
Blue Hybrid case study narration: The queue held 866 messages. Automation reduced the immediate decision queue to three, without ever treating a familiar domain as proof that a message was safe.
Dramatised with a synthetic consultant. Based on anonymised Blue Hybrid delivery records. No client, customer or employee is depicted.
Your situation will be different
Bring us the visible request. We will investigate the decision underneath it.
What happens next
- Share the problem, timing and intended outcome
- We review mutual fit and delivery capacity
- If aligned, we invite the next conversation