Let users report suspicious Teams messages to the security team

Description

Users can report Teams messages (and, where available, calls and meetings) as a security concern, and the reports reach the organization:

• in the Teams admin center, Report a security concern is on in the Global messaging policy and in every custom messaging policy (AllowSecurityEndUserReporting = True);
• in the Microsoft Defender portal, Monitor reported items in Microsoft Teams is on, and the reported items go to Microsoft, to the reporting mailbox of the security team, or both (ReportChatMessageEnabled or ReportChatMessageToCustomizedAddressEnabled = True).

Rationale

Teams is now a common phishing channel, and users are often the first to see a malicious chat. Without a report button, those signals are lost or arrive as tickets without the message. Reports in the Defender Submissions page give the SOC the message and its sender, raise an alert, and feed Microsoft's filtering.

Impact

Reported messages and up to fifteen surrounding messages may be sent to Microsoft for analysis when Microsoft is a destination; choose My reporting mailbox only if that is not acceptable. Someone must triage reports. Not available in GCC, GCC High and DoD.

Applies when

Requires: Microsoft Teams, Microsoft Defender for Office 365 Plan 1

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader. Browse to Messaging > Messaging policies and open the Global policy and each custom policy: Report a security concern must be On.
2. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader. Browse to Settings > Email & collaboration > Teams user reported settings: Monitor reported items in Microsoft Teams must be on, with a destination under Send the reported items to.
3. Read-only PowerShell: Get-CsTeamsMessagingPolicy | Select-Object Identity, AllowSecurityEndUserReporting (Teams PowerShell), and Get-ReportSubmissionPolicy | Format-List ReportChatMessageEnabled, ReportChatMessageToCustomizedAddressEnabled, ReportChatMessageAddresses (Exchange Online PowerShell, View-Only Organization Management or Global Reader).
4. Fail if reporting is off in a messaging policy assigned to users, or if both ReportChatMessageEnabled and ReportChatMessageToCustomizedAddressEnabled are False.

Remediation

1. In the Teams admin center, browse to Messaging > Messaging policies, open the Global policy, turn on Report a security concern and Save; repeat for custom policies. Role: Teams Administrator. PowerShell equivalent: Set-CsTeamsMessagingPolicy -Identity Global -AllowSecurityEndUserReporting $true.
2. In the Defender portal, browse to Settings > Email & collaboration > Teams user reported settings, turn on Monitor reported items in Microsoft Teams, choose the destination (the same reporting mailbox as email reports, CB-M365-MAIL-033) and Save. Role: Security Administrator. PowerShell equivalent: Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -ReportChatMessageEnabled $true -ReportChatMessageToCustomizedAddressEnabled $true -ReportChatMessageAddresses [email protected].
3. Check that the SOC triages the User reported tab of Submissions.

References

• User reported settings in Teams Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsMessagingPolicy Microsoft, vendor-doc, accessed 2026-10-24
• Set-ReportSubmissionPolicy Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-033 Keep zero-hour auto purge enabled for Teams messages
• related CB-M365-MAIL-033 Send user-reported messages to Microsoft and to a reporting mailbox

People and lifecycle