Exchange.ManageAsApp
— application permission, granted to the app registration with admin consent.
Endpoint:
Get-QuarantineMessage -StartReceivedDate (30 days)
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Quarantine Backlog & Release Requests (30 days)
What Microsoft 365 quarantined, which messages users asked to have released, and - most importantly - high-confidence phishing or malware that was released anyway. A released malware message is an incident.