{
  "id": "CB-M365-MAIL-033",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-033",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-033.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-033.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-033",
    "title": "Send user-reported messages to Microsoft and to a reporting mailbox",
    "finding": {
      "title": "Messages that users report as phishing do not reach the security team",
      "description": "The built-in Report button is off, or reports only go to Microsoft, so the SOC misses early warnings of a campaign."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-office-365",
      "user-reported-messages",
      "phishing",
      "soc",
      "submissions"
    ],
    "description": "The user reported settings are configured so that:\n\n- **Monitor reported messages in Outlook** is on and users report with the built-in **Report**\n  button in Outlook (`EnableReportToMicrosoft`, `ReportJunkToCustomizedAddress`,\n  `ReportPhishToCustomizedAddress`, `ReportNotJunkToCustomizedAddress`);\n- reported messages are sent to **Microsoft and my reporting mailbox**, the reporting mailbox\n  being {{ report_mailbox }} (`ReportJunkAddresses`, `ReportPhishAddresses`,\n  `ReportNotJunkAddresses` and the report submission rule);\n- **Monitor reported messages in Microsoft Teams** is on when Teams is used;\n- users can report messages from quarantine.\n",
    "rationale": "Users are often the first to spot a phishing campaign that filters missed. Sending their reports\nto a mailbox the SOC watches lets it purge the campaign from every mailbox quickly; sending them to\nMicrosoft as well improves future filtering and, with Defender for Office 365 Plan 2, triggers\nautomated investigation.\n",
    "impact": "The SOC must watch the reporting mailbox or the **User reported** tab in **Submissions**. Third-\nparty report add-ins should be removed or pointed to the same mailbox to avoid two channels.\n",
    "notes": "Microsoft recommends identifying the reporting mailbox as a SecOps mailbox in the advanced\ndelivery policy, so that reported messages are not filtered again on the way.\n",
    "parameters": [
      {
        "name": "report_mailbox",
        "type": "string",
        "description": "Exchange Online mailbox that receives user-reported messages.",
        "default": "a dedicated mailbox monitored by the security operations team"
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Settings** > **Email & collaboration** > **User reported settings**.\n3. Check that **Monitor reported messages in Outlook** is selected with **Use the built-in Report\n   button in Outlook**, that **Send reported messages to** is **Microsoft and my reporting\n   mailbox** with the expected mailbox, that **Monitor reported messages in Microsoft Teams** is\n   selected, and that reporting from quarantine is allowed.\n4. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-ReportSubmissionPolicy | Format-List EnableReportToMicrosoft, ReportJunkToCustomizedAddress, ReportPhishToCustomizedAddress,\n     ReportNotJunkToCustomizedAddress, ReportJunkAddresses, ReportPhishAddresses, ReportNotJunkAddresses, ReportChatMessageEnabled,\n     ReportChatMessageToCustomizedAddressEnabled, EnableThirdPartyAddress\n   Get-ReportSubmissionRule | Format-List Name, State, SentTo\n   ```\n5. Fail if reporting in Outlook is off, if reports do not reach both Microsoft and the reporting\n   mailbox, or if the rule is disabled.\n"
    },
    "remediation": {
      "manual": "1. Create the reporting mailbox (a shared mailbox is enough) and give the SOC access.\n2. In the Defender portal, **Settings** > **Email & collaboration** > **User reported settings**\n   (Security Administrator): select **Monitor reported messages in Outlook** > **Use the built-in\n   Report button in Outlook**, set **Send reported messages to** to **Microsoft and my reporting\n   mailbox**, enter the mailbox, select **Monitor reported messages in Microsoft Teams** and\n   reporting from quarantine, and save.\n3. PowerShell equivalent:\n   ```powershell\n   Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -EnableReportToMicrosoft $true `\n     -ReportJunkToCustomizedAddress $true -ReportNotJunkToCustomizedAddress $true -ReportPhishToCustomizedAddress $true `\n     -ReportJunkAddresses reports@example.com -ReportNotJunkAddresses reports@example.com -ReportPhishAddresses reports@example.com\n   Set-ReportSubmissionRule -Identity DefaultReportSubmissionRule -SentTo reports@example.com\n   ```\n4. Add the mailbox as a SecOps mailbox in **Email & collaboration** > **Policies & rules** >\n   **Threat policies** > **Advanced delivery**.\n"
    },
    "references": [
      {
        "title": "User reported settings",
        "url": "https://learn.microsoft.com/defender-office-365/submissions-user-reported-messages-custom-mailbox",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-ReportSubmissionPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-reportsubmissionpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD Blueprint for Secure Cloud - User reported settings",
        "url": "https://blueprint.asd.gov.au/configuration/defender/system/settings/email-and-collaboration/user-reported-settings/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IR-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-034",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-032",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}