Send user-reported messages to Microsoft and to a reporting mailbox

Description

The user reported settings are configured so that:

• Monitor reported messages in Outlook is on and users report with the built-in Report button in Outlook (EnableReportToMicrosoft, ReportJunkToCustomizedAddress, ReportPhishToCustomizedAddress, ReportNotJunkToCustomizedAddress);
• reported messages are sent to Microsoft and my reporting mailbox, the reporting mailbox being {{ report_mailbox }} (ReportJunkAddresses, ReportPhishAddresses, ReportNotJunkAddresses and the report submission rule);
• Monitor reported messages in Microsoft Teams is on when Teams is used;
• users can report messages from quarantine.

Microsoft recommends identifying the reporting mailbox as a SecOps mailbox in the advanced delivery policy, so that reported messages are not filtered again on the way.

Rationale

Users are often the first to spot a phishing campaign that filters missed. Sending their reports to a mailbox the SOC watches lets it purge the campaign from every mailbox quickly; sending them to Microsoft as well improves future filtering and, with Defender for Office 365 Plan 2, triggers automated investigation.

Impact

The SOC must watch the reporting mailbox or the User reported tab in Submissions. Third- party report add-ins should be removed or pointed to the same mailbox to avoid two channels.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Settings > Email & collaboration > User reported settings.
3. Check that Monitor reported messages in Outlook is selected with Use the built-in Report button in Outlook, that Send reported messages to is Microsoft and my reporting mailbox with the expected mailbox, that Monitor reported messages in Microsoft Teams is selected, and that reporting from quarantine is allowed.
4. In Exchange Online PowerShell (read-only):

   Get-ReportSubmissionPolicy | Format-List EnableReportToMicrosoft, ReportJunkToCustomizedAddress, ReportPhishToCustomizedAddress,
     ReportNotJunkToCustomizedAddress, ReportJunkAddresses, ReportPhishAddresses, ReportNotJunkAddresses, ReportChatMessageEnabled,
     ReportChatMessageToCustomizedAddressEnabled, EnableThirdPartyAddress
   Get-ReportSubmissionRule | Format-List Name, State, SentTo
   

5. Fail if reporting in Outlook is off, if reports do not reach both Microsoft and the reporting mailbox, or if the rule is disabled.

Remediation

1. Create the reporting mailbox (a shared mailbox is enough) and give the SOC access.
2. In the Defender portal, Settings > Email & collaboration > User reported settings (Security Administrator): select Monitor reported messages in Outlook > Use the built-in Report button in Outlook, set Send reported messages to to Microsoft and my reporting mailbox, enter the mailbox, select Monitor reported messages in Microsoft Teams and reporting from quarantine, and save.
3. PowerShell equivalent:

   Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -EnableReportToMicrosoft $true `
     -ReportJunkToCustomizedAddress $true -ReportNotJunkToCustomizedAddress $true -ReportPhishToCustomizedAddress $true `
     -ReportJunkAddresses [email protected] -ReportNotJunkAddresses [email protected] -ReportPhishAddresses [email protected]
   Set-ReportSubmissionRule -Identity DefaultReportSubmissionRule -SentTo [email protected]
   

4. Add the mailbox as a SecOps mailbox in Email & collaboration > Policies & rules > Threat policies > Advanced delivery.

References

• User reported settings Microsoft, vendor-doc, accessed 2026-10-24
• Set-ReportSubmissionPolicy Microsoft, vendor-doc, accessed 2026-10-24
• ASD Blueprint for Secure Cloud - User reported settings Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-034 Turn on automated remediation of malicious message clusters in AIR
• related CB-M365-COLLAB-032 Let users report suspicious Teams messages to the security team
• related CB-M365-AUDIT-008 Turn on key Microsoft 365 alert policies and route them to a monitored destination

People and lifecycle