Defender for Office 365 user-reported messages: Report button, reporting mailbox, triage

When users spot a phishing message, the Report button in Outlook is your early-warning system. It only works if the reports land somewhere useful: a reporting mailbox that isn't filtered, the Submissions page and, ideally, Microsoft's analysis. In this post I'll set up user reported settings in the Microsoft Defender portal, prepare the reporting mailbox, triage reports and send feedback, and explain the verified reasons the Report button doesn't appear.

How it works#

When a user selects Report › Report phishing or Report junk in a supported Outlook version, three things happen. The message goes to your reporting mailbox, to Microsoft, or to both. A copy appears on the User reported tab of the Submissions page. And Outlook acts on the original: junk is moved to Junk Email and the sender is added to the user's Blocked Senders list, phishing is deleted, and Not junk moves the message back to the Inbox. With Defender for Office 365 Plan 2, a phishing report also starts an automated investigation (AIR).

Prerequisites#

• Permissions: Security Administrator (Exchange Online role group or Microsoft Entra role) or Hygiene Management, plus access to Exchange Online PowerShell. Without that access, you get the error Specify an email address in your domain.
• A dedicated Exchange Online mailbox for reports. Distribution groups and external or on-premises mailboxes aren't allowed. If you never set one, the global admin's mailbox is used.
• Supported Outlook versions. Microsoft lists Current Channel 16.0.17827.15010 or later, Monthly Enterprise Channel 16.0.18025.20000 or later, Semi-Annual Channel release 2502 (build 16.0.18526.20024) or later, Outlook for Mac 16.89 or later, Outlook for iOS 4.2511 or later, Outlook for Android 4.2446 or later, new Outlook for Windows and Outlook on the web.

Step-by-step#

1. Prepare the reporting mailbox#

Reported messages are often malicious, so they must reach the mailbox without being filtered or rewritten:

• Add it as a SecOps mailbox in Email & collaboration › Policies & rules › Threat policies › Advanced delivery. If you run Attack simulation training or a third-party simulation tool, this matters even more. Without it, a reported simulation can trigger a training assignment.
• Exclude it from data loss prevention policies if you use DLP.

2. Configure user reported settings#

Go to Settings › Email & collaboration › User reported settings (https://security.microsoft.com/securitysettings/userSubmission):

1. Select Monitor reported messages in Outlook. If it's cleared, the whole Microsoft-integrated reporting experience is off, including reporting from quarantine.
2. Choose Use the built-in Report button in Outlook.
3. Under Send reported items to, pick a destination and add your reporting mailbox.
4. Optionally turn on Ask the user to confirm before reporting and Show a success message after the message is reported. You can customize these pop-ups in up to seven languages.
5. Under Email notifications, customize the results email for Phishing, Junk and No threats found. Plan 2 can also email users the AIR result automatically. Notifications come from submissions@messaging.microsoft.com unless you specify your own sender.
6. Keep Allow reporting for quarantined items selected, then select Save.

In PowerShell, the settings are one report submission policy plus one rule that holds the mailbox:

Get-ReportSubmissionPolicy | Format-List EnableReportToMicrosoft, EnableThirdPartyAddress, ReportPhishAddresses, ReportJunkAddresses
Get-ReportSubmissionRule | Format-List Name, SentTo

Both cmdlets return nothing until someone opens the settings page or creates the objects. If you set the mailbox with Set-ReportSubmissionRule, it isn't copied into the policy, so update both with the same address.

3. Using a third-party report button instead#

Select Use a non-Microsoft add-in button. Reports can then go to the reporting mailbox only, or to the mailbox and Microsoft, but not to Microsoft only. For the Submissions page to understand them, the tool has to meet these rules:

• It attaches the original, unmodified message as an uncompressed .eml or .msg file. Forwarding strips required headers, and messages with several attached messages are discarded.
• It starts the subject with 1| or Junk:, 2| or Not junk:, or 3| or Phishing:. Messages without a prefix are treated as phishing.
• It runs on its own. Don't run it alongside the built-in button, because duplicate reports just create noise.

4. Triage on the Submissions page#

Open Actions & submissions › Submissions › User reported. For each report, check the result and open its details. Then do one of the following:

• Use Submit to Microsoft for analysis for anything marked Not Submitted to Microsoft.
• Use Mark as and notify to send the user your verdict, with the template for Phishing, Junk or No threats found.
• Block the sender, URL or file in the Tenant Allow/Block List when it's confirmed malicious.

Microsoft says results based on overrides or policy show within minutes, while detonation and grader feedback can take up to a day.

Why the Report button is missing#

• Monitor reported messages in Outlook isn't selected, or a non-Microsoft add-in button is configured. The built-in button appears only when user reporting is on and the built-in button is chosen.
• The Outlook build is older than the minimum versions listed above.
• The mailbox isn't in Exchange Online. This feature is for cloud mailboxes.
• Shared mailboxes: in the Outlook versions where Microsoft supports reporting from shared mailboxes or as a delegate, the delegate needs Send As on the shared mailbox. Without it, the message is only removed from the folder and never reaches the reporting mailbox.

Verify#

1. Have a test user report a harmless external message as phishing.
2. Within minutes, it should appear on the User reported tab and in the reporting mailbox. With Plan 2, an investigation should also start.
3. Use Mark as and notify, and confirm the user receives the results email.
4. Rerun the two PowerShell commands above and check that the policy and the rule show the same mailbox.

Tips & gotchas#

• Don't leave reports going to the global admin's mailbox by default. Use a monitored, dedicated mailbox.
• If you choose My reporting mailbox only, make sure someone actually submits the reports to Microsoft. Otherwise Microsoft never learns from your users.
• For false positives from quarantine, see handling quarantined email the right way. To train users with realistic phishing, see Attack simulation training.

References#

• User reported settings (Microsoft Learn)
• Report phishing and suspicious emails in Outlook for admins (Microsoft Learn)
• Use the Submissions page to submit messages to Microsoft (Microsoft Learn)