{
  "id": "CB-M365-COLLAB-032",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-032",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-032.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-032.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-032",
    "title": "Let users report suspicious Teams messages to the security team",
    "finding": {
      "title": "Users cannot report suspicious Teams messages",
      "description": "Phishing and malicious content received in Teams chats and channels reaches users with no reporting path to the security team or to Microsoft."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "user-reporting",
      "phishing",
      "defender-for-office-365"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams",
        "Microsoft Defender for Office 365 Plan 1"
      ]
    },
    "description": "Users can report Teams messages (and, where available, calls and meetings) as a security concern,\nand the reports reach the organization:\n\n- in the Teams admin center, **Report a security concern** is on in the Global messaging policy and\n  in every custom messaging policy (`AllowSecurityEndUserReporting` = `True`);\n- in the Microsoft Defender portal, **Monitor reported items in Microsoft Teams** is on, and the\n  reported items go to Microsoft, to the reporting mailbox of the security team, or both\n  (`ReportChatMessageEnabled` or `ReportChatMessageToCustomizedAddressEnabled` = `True`).\n",
    "rationale": "Teams is now a common phishing channel, and users are often the first to see a malicious chat.\nWithout a report button, those signals are lost or arrive as tickets without the message. Reports in\nthe Defender **Submissions** page give the SOC the message and its sender, raise an alert, and feed\nMicrosoft's filtering.\n",
    "impact": "Reported messages and up to fifteen surrounding messages may be sent to Microsoft for analysis when\nMicrosoft is a destination; choose **My reporting mailbox only** if that is not acceptable. Someone\nmust triage reports. Not available in GCC, GCC High and DoD.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader. Browse to **Messaging** > **Messaging policies** and open the Global policy and\n   each custom policy: **Report a security concern** must be **On**.\n2. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security\n   Reader. Browse to **Settings** > **Email & collaboration** > **Teams user reported settings**:\n   **Monitor reported items in Microsoft Teams** must be on, with a destination under **Send the\n   reported items to**.\n3. Read-only PowerShell:\n   `Get-CsTeamsMessagingPolicy | Select-Object Identity, AllowSecurityEndUserReporting` (Teams\n   PowerShell), and\n   `Get-ReportSubmissionPolicy | Format-List ReportChatMessageEnabled, ReportChatMessageToCustomizedAddressEnabled, ReportChatMessageAddresses`\n   (Exchange Online PowerShell, View-Only Organization Management or Global Reader).\n4. Fail if reporting is off in a messaging policy assigned to users, or if both\n   `ReportChatMessageEnabled` and `ReportChatMessageToCustomizedAddressEnabled` are `False`.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Messaging** > **Messaging policies**, open the Global\n   policy, turn on **Report a security concern** and **Save**; repeat for custom policies. Role:\n   Teams Administrator. PowerShell equivalent:\n   `Set-CsTeamsMessagingPolicy -Identity Global -AllowSecurityEndUserReporting $true`.\n2. In the Defender portal, browse to **Settings** > **Email & collaboration** > **Teams user\n   reported settings**, turn on **Monitor reported items in Microsoft Teams**, choose the\n   destination (the same reporting mailbox as email reports, CB-M365-MAIL-033) and **Save**. Role:\n   Security Administrator. PowerShell equivalent:\n   `Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -ReportChatMessageEnabled $true -ReportChatMessageToCustomizedAddressEnabled $true -ReportChatMessageAddresses soc@example.com`.\n3. Check that the SOC triages the **User reported** tab of **Submissions**.\n"
    },
    "references": [
      {
        "title": "User reported settings in Teams",
        "url": "https://learn.microsoft.com/defender-office-365/submissions-teams",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsMessagingPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmessagingpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-ReportSubmissionPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-reportsubmissionpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IR-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-033",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-033",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}