Start with the quarantine reason and policy/detection information available in Microsoft Defender.
Review sender identities, authentication, URLs, attachments and message headers according to your organization’s permissions and tooling.
If the message is legitimate, determine whether it was a one-off false positive or a policy/configuration problem affecting a broader sender.
Do not create broad allow entries merely to release one message. An allow can weaken future filtering beyond the original case.