Threat Explorer Download ^hot^ Email Greyed Out May 2026

Threat Explorer requires Microsoft Defender for Office 365 Plan 2 (included in E5/A5/G5 suites). If you have Plan 1, you may only have access to "Real-time detections," which has limited action capabilities.

If you are investigating a suspicious message in and find the "Download email" or "Preview" buttons greyed out in Threat Explorer , you are likely facing a configuration issue rather than a system bug. threat explorer download email greyed out

You need to be a member of a role group that includes the role. By default, this role is only assigned to the Data Investigator and eDiscovery Manager role groups. Explorer permission to download an email Threat Explorer requires Microsoft Defender for Office 365

Even Global Administrators often find these options disabled because Microsoft intentionally separates tenant administration from direct content access to maintain a "least-privilege" security model. Why the Download Button is Greyed Out You need to be a member of a

The primary reason for this issue is a lack of specific roles. General administrative roles (like Global Admin or Security Admin) grant you the right to see metadata—such as who sent the email and where it went—but they do not automatically grant the right to view or download the actual content. Other common causes include:

This is the most common culprit. Without this specific permission assigned to your role group, the buttons will remain inactive.