Where do I find the Report button in Outlook?

In supported versions of Outlook, the Report button sits in the ribbon or in a message's menu. It's available in Outlook for Microsoft 365, the new Outlook for Windows, Outlook on the web, Outlook for Mac and the mobile apps, provided your admin has turned on user reporting.

What happens to a message I report as phishing?

The message is removed from your mailbox and, depending on the settings, goes to your organisation's reporting mailbox, to Microsoft, or both. An admin can then review the report.

Isn't forwarding it to the IT partner enough?

Forwarding often loses technical details of the original message, and the email stays in your inbox. With the Report button the message itself arrives, with all the details needed to review it.

Does the Report button cost extra?

The built-in Report button is part of Microsoft 365 with Exchange Online. You don't need a separate licence for it.

What if I accidentally report a good email as phishing?

That's not a problem. An admin sees the report and can mark the message as clean. Reporting is never wrong: better one report too many than one too few.

Report a suspicious email in one click? How an SME sets up the Report button in Outlook in Microsoft 365

An employee who's unsure about an email often forwards it to a colleague or to the IT partner. That's well meant, but the original message gets lost that way, and nobody knows how many people received the same email. Microsoft 365 has a built-in Report button in Outlook for this. When it's set up properly, everyone reports suspicious email the same way and your admin can act quickly.

Why forwarding isn't enough

Many businesses have a simple rule: if you're unsure about an email, forward it to the IT partner. That only half works. Forwarding often loses the technical details of the original message, such as the real sender and the route the message took. On top of that, the suspicious email is still sitting in the employee's inbox, and in the inboxes of colleagues who received it too.

With the Report button, the message itself goes to the place you've set up, with all the details an admin needs. A message reported as phishing is removed from the reporter's mailbox straight away, so that employee won't click it later after all.

What the Report button does

The built-in Report button is available in Outlook for Microsoft 365 (recent versions), the new Outlook for Windows, Outlook on the web, Outlook for Mac and the Outlook apps for iOS and Android. The employee selects a message, chooses Report and then one of the options:

Report phishing. For email that tries to obtain login details, money or data. The message is deleted.
Report junk. For spam and advertising. The message moves to the Junk Email folder and the sender is added to that employee's Blocked Senders list.
Not junk. For good email that ended up in Junk Email by mistake. The message moves back to the Inbox.

The button only appears when user reporting is turned on and the built-in button is selected in the settings. If you already use a report button from another vendor, for example from a training platform, check which of the two is active so staff don't see two different buttons.

Where do the reports go?

In the Microsoft Defender portal, an admin chooses where reported messages end up:

To a reporting mailbox. A mailbox in your own organisation where all reports arrive. Useful when your IT partner reviews them and you want to see what gets reported yourself.
To Microsoft. Microsoft analyses the message. That helps improve the filters, including for your own organisation.
To both. For most SMEs the logical choice: you keep visibility yourself and Microsoft gets the report.

All reports also appear on the Submissions page in the Defender portal, on the tab for user reported messages. There an admin can review and mark a report, for example as phishing or as clean, and send the employee a message about it. You can also have staff see a confirmation before reporting and a short thank-you message afterwards. You can customise those texts yourself.

After the report: agree who does what

A Report button only makes sense if someone looks at the reports. So agree on:

Who reviews the reports and how quickly, especially for phishing that reached several employees.
What happens with real phishing. For example removing the same message from other mailboxes, blocking the sender or domain, and checking whether anyone already clicked.
What an employee does who already clicked or entered something. Then reporting isn't enough: change the password and revoke sessions, as in our step-by-step plan for a compromised Microsoft 365 account.
That reporting is never wrong. An employee who reports a good email once shouldn't get any hassle for it. Better ten reports too many than one too few.

Explain the button to your staff too, for example during a short security awareness training. Show where the button is in the apps they use, including on their phone.

How Floor ICT handles this

Floor ICT turns on user reporting, chooses with you where the reports go and sets up a reporting mailbox if needed. We check that the button is visible in every version of Outlook you use. We also review the reports and follow up on real phishing, together with the protection that's already on, such as anti-phishing and quarantine. That way every suspicious email is reported the same way and something actually gets done with it.

View MSP packages Request an intake Microsoft 365