# How do you set up the Report button and user reported settings in Microsoft 365?

URL: https://iblockspam.com/blog/microsoft-365-report-message-user-reported-settings
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Set up the Outlook Report button in Microsoft 365: user reported settings, a reporting mailbox, reviewing reports on the Submissions page and sending users feedback.

## Short answer

In the Microsoft Defender portal, open Settings > Email & collaboration > User reported settings, select Monitor reported messages in Outlook and Use the built-in Report button in Outlook, then send reports to Microsoft, a reporting mailbox, or both. Make the reporting mailbox a SecOps mailbox, and review reports on the User reported tab of the Submissions page.

Your users will see phishing that every filter missed. Whether that turns into a five-second report or a forwarded "is this real?" email depends on how you've set up reporting. Microsoft 365 has a built-in **Report** button in Outlook, a settings page that decides where reports go, and a review queue in the Defender portal. Many tenants run with the defaults, which send copies of every report to a global admin's inbox.

This guide covers the admin side: configuring the button, choosing a destination, reviewing reports and closing the loop with users. For the user-facing steps, send staff our guide on [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email).

## How does the built-in Report button work?

The **Report** button is a split button in Outlook. Selecting it directly reports phishing; the dropdown offers **Report phishing**, **Report junk** and, in the Junk Email folder, **Not junk**. It's available in recent builds of Outlook for Microsoft 365, the new Outlook for Windows, Outlook on the web, Outlook for Mac, and Outlook for iOS and Android ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-outlook-report-messages)).

What each action does to the message:

| Action | Message | Sender |
|---|---|---|
| Report phishing | Deleted | No change |
| Report junk | Moved to Junk Email | Added to the user's Blocked Senders list |
| Not junk | Moved from Junk Email to Inbox | No change |

The Blocked Senders side effect explains a lot of "why does this supplier always go to Junk?" tickets. Our guide to [Microsoft 365 emails going to Junk](https://iblockspam.com/blog/microsoft-365-emails-going-to-junk) shows how to spot it (`SFV:BLK`) and undo it.

In several clients, including Outlook on the web and the new Outlook, users can report from shared mailboxes. Microsoft notes they need **Send As** permission on that mailbox; without it, the message is only removed from the folder and never reaches the reporting mailbox.

## Where are user reported settings?

In the Microsoft Defender portal, go to **Settings** > **Email & collaboration** > **User reported settings**, or open `https://security.microsoft.com/securitysettings/userSubmission`. You need the **Security Administrator** or **Hygiene Management** role group, or the Entra **Security Administrator** role ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-user-reported-messages-custom-mailbox)).

The top setting, **Monitor reported messages in Outlook**, switches the whole integrated experience on or off. Below it you choose one of two button configurations:

- **Use the built-in Report button in Outlook**
- **Use a non-Microsoft add-in button**

You can't run both in Microsoft's model, and Microsoft advises against having users see two report buttons because duplicate reports create noise.

## Where should reports go?

**Send reported items to** has three options for the built-in button:

| Option | Goes to Microsoft | Goes to your mailbox | Shows on the User reported tab |
|---|---|---|---|
| Microsoft and my reporting mailbox (default) | Yes | Yes | Yes |
| My reporting mailbox only | No, until an admin submits it | Yes | Yes, as **Not Submitted to Microsoft** |
| Microsoft only | Yes | No | Yes |

For most businesses, **Microsoft and my reporting mailbox** is the right choice. Microsoft analyzes every report, which helps its filters, and your team sees the original message. **My reporting mailbox only** suits organizations that can't let data leave their boundary; Microsoft says it's the only option in US Government clouds. Third-party add-ins can use the first two options but not **Microsoft only**.

### Set up the reporting mailbox properly

The reporting mailbox must be an Exchange Online mailbox. Microsoft doesn't allow distribution groups or routing to an external or on-premises mailbox. Before you point reports at it:

1. Create a dedicated shared or user mailbox, such as `phish-reports@yourdomain.example`.
2. Add it as a **SecOps mailbox** in the advanced delivery policy, so reported messages arrive unfiltered. Microsoft calls this "especially important" if you run phishing simulations, because otherwise a report could trigger a training assignment.
3. Exclude it from data loss prevention policies, if you use DLP.
4. Give the people who triage reports access to it.

## How do you configure the settings, step by step?

1. Open **User reported settings** and select **Monitor reported messages in Outlook**.
2. Select **Use the built-in Report button in Outlook**.
3. Under **When the user reports an email**, decide whether to **Ask the user to confirm before reporting** and **Show a success message after the message is reported**. Select **Customize messages** to write your own pop-up text, for example "Thanks. IT will review this within one business day."
4. Under **Reported item destinations**, choose **Microsoft and my reporting mailbox** and enter the reporting mailbox.
5. Under **Email notifications**, select **Customize results email** to write the text users get after review. Optionally set your own From address; otherwise Microsoft uses `submissions@messaging.microsoft.com`.
6. Under **Report from quarantine**, keep **Allow reporting for quarantined items** selected so users can report false positives as they release mail.
7. Select **Save**.

The same settings are available in Exchange Online PowerShell through the `*-ReportSubmissionPolicy` and `*-ReportSubmissionRule` cmdlets. Run `Get-ReportSubmissionPolicy` to check what's set; Microsoft notes it returns nothing if nobody has ever opened the settings page.

## How do admins review user reports?

Reports appear on the **User reported** tab of the **Submissions** page: **Actions & submissions** > **Submissions**, or `https://security.microsoft.com/reportsubmission?viewid=user`. Quick filters include **Threats**, **Spam**, **No threats** and **Simulations**. The **Result** column shows Microsoft's analysis, which covers policy hits, payload detonation and, where needed, human graders ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-admin)).

For each report you can:

- **Submit to Microsoft for analysis.** Needed for reports that went only to your mailbox, or when you disagree with Microsoft's verdict. For a confirmed threat, you can also select **Block all emails from this sender or domain**, which adds a Tenant Allow/Block List entry that expires after 30 days by default. For a confirmed clean message, **Allow this message** creates an entry removed 45 days after last use.
- **Mark as and notify.** Mark the report as **No threats found**, **Phishing** or **Spam**, which emails the reporting user automatically. Microsoft's admin review article describes this for organizations with Defender for Office 365.
- **Trigger investigation.** In Defender for Office 365 Plan 2 only, this starts an automated investigation.

Microsoft points out that a reported message can't be "unreported", but the user can recover it from Deleted Items or Junk Email.

### Admin submissions for anything users didn't report

The **Emails** tab on the same page lets admins submit messages directly, by network message ID or by uploading the .eml or .msg file. Microsoft accepts messages up to 30 days old if they're still in the mailbox, and throttles submissions to 150 in any 15 minutes. Choosing a recipient runs a policy check that shows whether an allow entry or override let the message through. That check is one of the quickest ways to find the cause when [spam gets through Microsoft 365](https://iblockspam.com/blog/microsoft-365-spam-getting-through).

## How do you give users feedback?

Feedback is what keeps people reporting. Three options:

1. **Mark as and notify** for individual reports, using the results email text you customized.
2. **Automatically email users the results of the investigation**, available only in Plan 2 with automated investigation and response. You choose whether to notify on **Phishing or malware**, **Spam** and **No threats found**.
3. **A human reply** from the reporting mailbox for anything serious. If a user reported a message after clicking, follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).

Thank people for false alarms too. Our guide to [security awareness training for small businesses](https://iblockspam.com/blog/email-security-awareness-training-small-business) covers building the habit.

## What about third-party report buttons?

**Microsoft's own add-ins.** Microsoft says the Report Message and Report Phishing add-ins "are now in maintenance mode and will eventually be deprecated", citing security issues and architectural limits ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-users-report-message-add-in-configure)). At the time of writing (October 2026), no retirement date was published. Remove them in the Microsoft 365 admin center under **Settings** > **Integrated apps** once the built-in button is live.

**Non-Microsoft buttons.** Microsoft lists Keepnet, KnowBe4 Phish Alert Button, Cofense, Hoxhunt and PhishAlarm as examples. To get these reports onto the **User reported** tab:

- Select **Use a non-Microsoft add-in button** and set the reporting mailbox.
- The tool must attach the original message unmodified, as an uncompressed .eml or .msg file. Forwarding strips the headers Microsoft needs, and messages with multiple attachments are discarded.
- The subject should start with `1|` or `Junk:`, `2|` or `Not junk:`, or `3|` or `Phishing:`. Microsoft treats a report with no prefix as phishing.

## How does a gateway's reporting fit in?

If your MX points to a filtering gateway in front of Microsoft 365, two systems now make decisions about each message, and each learns from its own reports. A simple rule keeps it straight: report to the layer that made the decision.

- **Phishing or spam that reached the inbox** passed both layers. The Outlook Report button sends it to Microsoft. If your gateway has its own reporting route, report it there as well so both engines learn.
- **Good mail held in the gateway's quarantine** never reached Microsoft 365. Release and report it in the gateway.
- **Good mail in Microsoft's quarantine or Junk Email** passed the gateway. Use Microsoft's **Not junk** or quarantine reporting.

Microsoft's own guidance on layered services says false positives caused by the other service "should be sent to the non-Microsoft service" because Microsoft "can't correct the issue" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)). Make sure the gateway passes mail through [Enhanced Filtering for Connectors](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering), so Microsoft's analysis of a reported message sees the original sender rather than the gateway.

With iBlockSpam, for example, users manage held mail in their personal [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests), while Microsoft's Report button keeps handling what reaches Outlook.

## Next steps

1. Open `https://security.microsoft.com/securitysettings/userSubmission` and check which mailbox receives reports today.
2. Create a dedicated reporting mailbox and add it as a SecOps mailbox.
3. Customize the pop-ups and results email, then tell staff where the button is.
4. Review the **User reported** tab at least daily, and submit mailbox-only reports to Microsoft.
5. Check a reported message's headers in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see why it got through, and tighten your [anti-spam policies](https://iblockspam.com/blog/microsoft-365-anti-spam-policies) if a pattern appears.

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Where do reported messages go by default in Microsoft 365?

Microsoft's default setting is Microsoft and my reporting mailbox, with no reporting mailbox filled in. In that case the reporting mailbox is the global admin's Exchange Online mailbox, which Microsoft only shows on the settings page after the first user reports a message. Set a dedicated reporting mailbox so reports don't land in an admin's inbox.

### Why is the Report button missing in Outlook?

The built-in Report button appears only when Monitor reported messages in Outlook is selected and the built-in button is chosen in user reported settings. It also needs a supported Outlook version. If your organization selected a non-Microsoft add-in instead, users see that add-in rather than Microsoft's button.

### What happens to an email when a user reports it as phishing?

The message is deleted from the user's mailbox and sent to Microsoft, the reporting mailbox, or both, depending on your settings. Reporting a message as junk moves it to Junk Email and adds the sender to the user's Blocked Senders list. Users can recover a reported message from Deleted Items or Junk Email.

### Are the Microsoft Report Message and Report Phishing add-ins being retired?

Microsoft says both add-ins are in maintenance mode and will eventually be deprecated. At the time of writing (October 2026), Microsoft hadn't published a retirement date. It recommends moving to the built-in Report button, which works across virtually all Outlook clients and supports shared and delegate mailboxes in several of them.

### Can I use KnowBe4 or another third-party report button with Microsoft 365?

Yes. Select Use a non-Microsoft add-in button in user reported settings and point it at a reporting mailbox. The tool must attach the original message, unmodified, as an .eml or .msg file, with a subject prefix such as Phishing: so Microsoft can classify it. Microsoft-only delivery isn't available for third-party buttons.

## Sources

- [Microsoft Learn: Configure user reported message settings](https://learn.microsoft.com/en-us/defender-office-365/submissions-user-reported-messages-custom-mailbox)
- [Microsoft Learn: Report phishing and suspicious emails in Outlook for admins](https://learn.microsoft.com/en-us/defender-office-365/submissions-outlook-report-messages)
- [Microsoft Learn: Submit messages, URLs, and attachments for analysis](https://learn.microsoft.com/en-us/defender-office-365/submissions-admin)
- [Microsoft Learn: Admin review for user reported messages](https://learn.microsoft.com/en-us/defender-office-365/submissions-admin-review-user-reported-messages)
- [Microsoft Learn: Transition from the Report Message or Report Phishing add-ins](https://learn.microsoft.com/en-us/defender-office-365/submissions-users-report-message-add-in-configure)
- [Microsoft Learn: Integrate non-Microsoft security services with Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-report-message-user-reported-settings (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt