In Microsoft 365 organizations with mailboxes in Exchange Online, users can report phishing and suspicious email in Outlook. Users can report false positives (good email that was blocked or sent to their Junk Email folder) and false negatives (unwanted email or phishing that was delivered to their Inbox) from Outlook on all platforms using free tools from Microsoft.
Microsoft provides the following tools for users to report good and bad messages:
The built-in Report button in supported versions of Outlook on virtually all Outlook platforms, including shared and delegate mailboxes.
Admins configure user reported messages to go to a specified reporting mailbox, to Microsoft, or both. These user reported messages are available on the User reported tab on the Submissions page in the Microsoft Defender portal. For more information, see User reported settings.
If user reporting is turned off and a non-Microsoft add-in button is selected, the Report button isn't available in supported versions of Outlook.
The built-in Report button in Outlook on the web, Outlook for Mac, Outlook for iOS, Outlook for Android, and the new Outlook for Windows supports reporting messages from shared mailboxes or other mailboxes by a delegate.
Shared mailboxes require Send As or Send On Behalf permission for the user.
Other mailboxes require Send As or Send On Behalf permission and Read and Manage permissions for the delegate.
Use the built-in Report button in Outlook to report junk and phishing messages
Users can report a message as junk from the Inbox or any email folder other than Junk Email folder.
Users can report a message as phishing from any email folder.
In a supported version of Outlook, select one or more messages, select Report, and then select Report phishing or Report junk in the dropdown list.
Based on the User reported settings in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The following actions are also taken on the reported messages in the mailbox:
Reported as junk: The messages are moved to the Junk Email folder.
Reported as phishing: The messages are deleted.
Use the built-in Report button in Outlook to report messages that aren't junk
In a supported version of Outlook, select one or more messages in the Junk Email folder, select Report, and then select Not junk in the dropdown list.
Based on the User reported settings in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The messages are also moved out of Junk Email to the Inbox.
If the User reported settings in the organization send user reported messages (email and Microsoft Teams) to Microsoft (exclusively or in addition to the reporting mailbox), we do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page. So, submitting or resubmitting messages to Microsoft is useful to admins only for messages that have never been submitted to Microsoft, or when you disagree with the original verdict.
More information
Admins can watch this short video to learn how to use Microsoft Defender for Office 365 to easily investigate user reported messages. Admins can determine the contents of a message and how to respond by applying the appropriate remediation action.
This module examines how Exchange Online Protection (EOP) protects organizations from phishing and spoofing. It also explores how EOP blocks spam, bulk email, and malware before they arrive in users’ mailboxes.
