How do you set up the Report button and user reported settings in Microsoft 365?

Your users will see phishing that every filter missed. Whether that turns into a five-second report or a forwarded "is this real?" email depends on how you've set up reporting. Microsoft 365 has a built-in Report button in Outlook, a settings page that decides where reports go, and a review queue in the Defender portal. Many tenants run with the defaults, which send copies of every report to a global admin's inbox.

This guide covers the admin side: configuring the button, choosing a destination, reviewing reports and closing the loop with users. For the user-facing steps, send staff our guide on how to report a phishing email.

How does the built-in Report button work?

The Report button is a split button in Outlook. Selecting it directly reports phishing; the dropdown offers Report phishing, Report junk and, in the Junk Email folder, Not junk. It's available in recent builds of Outlook for Microsoft 365, the new Outlook for Windows, Outlook on the web, Outlook for Mac, and Outlook for iOS and Android (Microsoft Learn).

What each action does to the message:

The Blocked Senders side effect explains a lot of "why does this supplier always go to Junk?" tickets. Our guide to Microsoft 365 emails going to Junk shows how to spot it (SFV:BLK) and undo it.

In several clients, including Outlook on the web and the new Outlook, users can report from shared mailboxes. Microsoft notes they need Send As permission on that mailbox; without it, the message is only removed from the folder and never reaches the reporting mailbox.

Where are user reported settings?

In the Microsoft Defender portal, go to Settings > Email & collaboration > User reported settings, or open https://security.microsoft.com/securitysettings/userSubmission. You need the Security Administrator or Hygiene Management role group, or the Entra Security Administrator role (Microsoft Learn).

The top setting, Monitor reported messages in Outlook, switches the whole integrated experience on or off. Below it you choose one of two button configurations:

• Use the built-in Report button in Outlook
• Use a non-Microsoft add-in button

You can't run both in Microsoft's model, and Microsoft advises against having users see two report buttons because duplicate reports create noise.

Where should reports go?

Send reported items to has three options for the built-in button:

For most businesses, Microsoft and my reporting mailbox is the right choice. Microsoft analyzes every report, which helps its filters, and your team sees the original message. My reporting mailbox only suits organizations that can't let data leave their boundary; Microsoft says it's the only option in US Government clouds. Third-party add-ins can use the first two options but not Microsoft only.

Set up the reporting mailbox properly

The reporting mailbox must be an Exchange Online mailbox. Microsoft doesn't allow distribution groups or routing to an external or on-premises mailbox. Before you point reports at it:

1. Create a dedicated shared or user mailbox, such as phish-reports@yourdomain.example.
2. Add it as a SecOps mailbox in the advanced delivery policy, so reported messages arrive unfiltered. Microsoft calls this "especially important" if you run phishing simulations, because otherwise a report could trigger a training assignment.
3. Exclude it from data loss prevention policies, if you use DLP.
4. Give the people who triage reports access to it.

How do you configure the settings, step by step?

1. Open User reported settings and select Monitor reported messages in Outlook.
2. Select Use the built-in Report button in Outlook.
3. Under When the user reports an email, decide whether to Ask the user to confirm before reporting and Show a success message after the message is reported. Select Customize messages to write your own pop-up text, for example "Thanks. IT will review this within one business day."
4. Under Reported item destinations, choose Microsoft and my reporting mailbox and enter the reporting mailbox.
5. Under Email notifications, select Customize results email to write the text users get after review. Optionally set your own From address; otherwise Microsoft uses submissions@messaging.microsoft.com.
6. Under Report from quarantine, keep Allow reporting for quarantined items selected so users can report false positives as they release mail.
7. Select Save.

The same settings are available in Exchange Online PowerShell through the *-ReportSubmissionPolicy and *-ReportSubmissionRule cmdlets. Run Get-ReportSubmissionPolicy to check what's set; Microsoft notes it returns nothing if nobody has ever opened the settings page.

How do admins review user reports?

Reports appear on the User reported tab of the Submissions page: Actions & submissions > Submissions, or https://security.microsoft.com/reportsubmission?viewid=user. Quick filters include Threats, Spam, No threats and Simulations. The Result column shows Microsoft's analysis, which covers policy hits, payload detonation and, where needed, human graders (Microsoft Learn).

For each report you can:

• Submit to Microsoft for analysis. Needed for reports that went only to your mailbox, or when you disagree with Microsoft's verdict. For a confirmed threat, you can also select Block all emails from this sender or domain, which adds a Tenant Allow/Block List entry that expires after 30 days by default. For a confirmed clean message, Allow this message creates an entry removed 45 days after last use.
• Mark as and notify. Mark the report as No threats found, Phishing or Spam, which emails the reporting user automatically. Microsoft's admin review article describes this for organizations with Defender for Office 365.
• Trigger investigation. In Defender for Office 365 Plan 2 only, this starts an automated investigation.

Microsoft points out that a reported message can't be "unreported", but the user can recover it from Deleted Items or Junk Email.

Admin submissions for anything users didn't report

The Emails tab on the same page lets admins submit messages directly, by network message ID or by uploading the .eml or .msg file. Microsoft accepts messages up to 30 days old if they're still in the mailbox, and throttles submissions to 150 in any 15 minutes. Choosing a recipient runs a policy check that shows whether an allow entry or override let the message through. That check is one of the quickest ways to find the cause when spam gets through Microsoft 365.

How do you give users feedback?

Feedback is what keeps people reporting. Three options:

1. Mark as and notify for individual reports, using the results email text you customized.
2. Automatically email users the results of the investigation, available only in Plan 2 with automated investigation and response. You choose whether to notify on Phishing or malware, Spam and No threats found.
3. A human reply from the reporting mailbox for anything serious. If a user reported a message after clicking, follow what to do after clicking a phishing link.

Thank people for false alarms too. Our guide to security awareness training for small businesses covers building the habit.

What about third-party report buttons?

Microsoft's own add-ins. Microsoft says the Report Message and Report Phishing add-ins "are now in maintenance mode and will eventually be deprecated", citing security issues and architectural limits (Microsoft Learn). At the time of writing (October 2026), no retirement date was published. Remove them in the Microsoft 365 admin center under Settings > Integrated apps once the built-in button is live.

Non-Microsoft buttons. Microsoft lists Keepnet, KnowBe4 Phish Alert Button, Cofense, Hoxhunt and PhishAlarm as examples. To get these reports onto the User reported tab:

• Select Use a non-Microsoft add-in button and set the reporting mailbox.
• The tool must attach the original message unmodified, as an uncompressed .eml or .msg file. Forwarding strips the headers Microsoft needs, and messages with multiple attachments are discarded.
• The subject should start with 1| or Junk:, 2| or Not junk:, or 3| or Phishing:. Microsoft treats a report with no prefix as phishing.

How does a gateway's reporting fit in?

If your MX points to a filtering gateway in front of Microsoft 365, two systems now make decisions about each message, and each learns from its own reports. A simple rule keeps it straight: report to the layer that made the decision.

• Phishing or spam that reached the inbox passed both layers. The Outlook Report button sends it to Microsoft. If your gateway has its own reporting route, report it there as well so both engines learn.
• Good mail held in the gateway's quarantine never reached Microsoft 365. Release and report it in the gateway.
• Good mail in Microsoft's quarantine or Junk Email passed the gateway. Use Microsoft's Not junk or quarantine reporting.

Microsoft's own guidance on layered services says false positives caused by the other service "should be sent to the non-Microsoft service" because Microsoft "can't correct the issue" (Microsoft Learn). Make sure the gateway passes mail through Enhanced Filtering for Connectors, so Microsoft's analysis of a reported message sees the original sender rather than the gateway.

With iBlockSpam, for example, users manage held mail in their personal quarantine and digests, while Microsoft's Report button keeps handling what reaches Outlook.

Next steps

1. Open https://security.microsoft.com/securitysettings/userSubmission and check which mailbox receives reports today.
2. Create a dedicated reporting mailbox and add it as a SecOps mailbox.
3. Customize the pop-ups and results email, then tell staff where the button is.
4. Review the User reported tab at least daily, and submit mailbox-only reports to Microsoft.
5. Check a reported message's headers in the Email Header Analyzer to see why it got through, and tighten your anti-spam policies if a pattern appears.

Browse more guides on running email day to day.