Reporting Suspicious Messages in M365 Shared and Delegated Mailboxes

Dear admins, the long wait is over! Microsoft announced the extension of support for reporting junk and phishing emails from shared & delegated mailboxes in the Outlook Web App soon. Reporting suspicious emails in Outlook is one of the most prominent features to identify phishing or junk emails received in your organization. Also, reporting suspicious messages to Microsoft will help them analyze further and act accordingly. Previously, this feature has been supported only in user mailboxes. Now, Microsoft lends a hand to shared and delegated mailboxes too. Isn’t it cool! Let’s see how it works.

Nowadays, cyberattacks are increasing tremendously with brand-new techniques. Security admins and cybersecurity experts try to find every possible way like reporting suspicious MFA requests, password spray attack detection, etc., to defend against such massive attacks and stay secure. Phishing, spoofing, etc., are the most common attacks to gain credentials through email. Though Microsoft introduces security policies, every single piece of information from users is important to find and prevent such attacks. Thus, reporting junk and phishing emails is the key feature in Outlook and helps Microsoft to improve its security practices. Moreover, extending the feature to Microsoft 365 shared and delegated mailboxes is an absolute treat for security admins.

The built-in Report message button in Outlook Web App facilitates users to report phishing, junk, and not junk emails to Microsoft for analysis. Admins can configure user-reported messages to go to a designated mailbox, to Microsoft, or both. Please note that this feature is available only in the Outlook web client. Before jumping deeply into them, we need to enable the report message feature in the organization.

This feature is enabled by default for all Microsoft 365 environments. If it is disabled for a reason, you can enable it by using the following steps.

• First, you must enable the ‘Monitor reported messages in Outlook’ on the User Reported Settings page. To do this, navigate to Microsoft Defender Portal–> Settings–> Email & Collaboration–> User Reported Settings

• Then, select the ‘Use the built-in Report button in Outlook” option.

Note: If any of the above is not enabled, users can’t find the built-in report button in the Outlook web app.

As mentioned earlier, it was available for Exchange Online mailboxes except shared and delegated mailboxes. Now, Microsoft is extending its hands to report messages in shared and delegated mailboxes using the Outlook Web App. To enable the report message feature, you should fulfill the prerequisites mentioned before. The work of reporting messages in shared and delegated mailboxes is the same as the user mailboxes.

According to MS, this feature starts rolling out in mid-May and will be completed by early June. Please wait patiently until your tenant gets this feature. To verify this feature in your organization, follow these steps.

• Open your Outlook web client.
• Open any shared or delegated mailbox you have access to.
• Look for the ‘Report’ button in the ribbon, as shown below.

• Open the Junk folder and verify the option, as shown below.

• For reporting messages from shared mailboxes, you need to assign ‘Send As or Send On Behalf’ permission for users in your organization. Else, users will get an error when they try to report messages in Outlook on the web.
• For reporting messages from delegated mailboxes, users should have ‘Send As’ or ‘Send On Behalf’, along with Read and Manage permissions in another user’s mailbox. Else, delegates will get an error while reporting messages in the Outlook web client.

For viewing the user reported messages, admins can follow the two following ways.

• Submissions Page in Microsoft Defender
• Configuring Mailbox in the ‘User Reporting Settings’ Page

Admins can view the user reported messages by navigating to Microsoft 365 Defender portal–> Actions & Submissions–> Submissions–> User reported. Also, admins can submit any messages from this page to Microsoft for further analysis.

While enabling the built-in Report button in Microsoft Defender, admins can configure the required mailbox under the ‘Reported message destinations’ section. Thus, admins can receive every user reported message in the configured mailbox.

• If the reporting feature is not enabled in the Microsoft 365 Defender portal, this feature will not be available in your organization.
• If you’re using a third-party add-in, you don’t need to consider this change.
• This new update will not be available for other Outlook clients like Mac, Windows, iOS, and Android.
• The reported message will be removed from the mailbox once reported. Thus, if any of the shared mailbox members reported a message, other members can’t view the message. Similarly, if the delegates report a message in the delegated mailbox, the mailbox owner may miss viewing the message.

I hope this blog will bring admins the great news of getting such useful features and guide them on reporting messages and their requirements. Stay tuned for further updates! Feel free to drop your queries.