Customize the Report Phishing Button icon

The Report Phishing Button add-in shows our default icon on the Outlook ribbon. If you want to match a client’s branding — their logo, a security-team icon, your own MSP mark — you can swap it by editing the manifest XML before uploading to Microsoft 365. This works for both v3 and v2.

You’ll need

• A square icon image, 80×80px recommended, PNG preferred. Outlook displays the icon at sizes ranging from 16 to 80 pixels, so square images at 80px give the cleanest result.
• A public HTTPS URL where the icon is hosted — no login required. Microsoft’s servers fetch the icon directly, so a URL that requires authentication or VPN won’t work. A public CDN, public S3 bucket, or any static site works fine.
• The manifest XML file — download it from the client’s Tailor → Report Phishing Button page in the dashboard.
• A plain-text editor (VS Code, Notepad++, TextEdit in plain-text mode, or anything that opens XML files).
• Microsoft 365 admin access to re-deploy the edited manifest.

Walkthrough

1. Host the icon at a public HTTPS URL. Before editing anything, confirm the URL works: open it in a private / incognito browser window with no stored cookies. If the image loads, Microsoft can fetch it. If it prompts for login or returns an error, fix that first.

2. Download the manifest. Open the client → Tailor → Report Phishing Button, then click Download Manifest v3 (or v2 if you’re using the legacy version). You’ll get an XML file.

3. Open the XML and find the icon entries. Open the file in your text editor. Search for the word DefaultValue — all icon slots use this attribute. You’re looking for lines like these near the top of the file:

   <IconUrl DefaultValue="https://prb.infimasec.com/v3/assets/icon-80.png"/>
   <HighResolutionIconUrl DefaultValue="https://prb.infimasec.com/v3/assets/icon-80.png"/>

   And further down in the Resources section:

   <bt:Image id="Icon.16x16" DefaultValue="https://prb.infimasec.com/v3/assets/icon-80.png"/>
   <bt:Image id="Icon.32x32" DefaultValue="https://prb.infimasec.com/v3/assets/icon-80.png"/>
   <bt:Image id="Icon.80x80" DefaultValue="https://prb.infimasec.com/v3/assets/icon-80.png"/>

   v3 has five icon entries; v2 has seven (two additional sizes for mobile). All of them can point to the same URL.

4. Replace the icon URLs. Use Find & Replace (Ctrl+H on Windows, Cmd+H on Mac) to replace every occurrence of the original icon URL with yours. Make sure all occurrences are updated — leaving any behind will show a mix of icons.

5. Save the edited XML.

6. Re-deploy the manifest in Microsoft 365 admin center. Go to admin.microsoft.com → Settings → Integrated Apps. If the add-in is already deployed, select it and choose Update (or Re-deploy) rather than uploading a new app — this refreshes the existing add-in without creating a duplicate. If it’s a fresh install, follow the same upload steps from the main Report Phishing Button guide.

   Allow up to 24 hours for Microsoft to propagate the update to users.

You’ll know it worked when

• Open Outlook as one of the client’s users. The Report Phishing button in the ribbon shows your custom icon instead of the default.
• Allow up to 24 hours after re-deploying. If you check immediately and still see the old icon, wait and check again.

Frequently asked

Does the icon URL need to stay live after deployment? Yes — Microsoft re-fetches the icon from the URL in the manifest on a recurring basis. If the URL goes down, Outlook falls back to a generic placeholder; the button still works but looks broken until the URL comes back.

All five slots point to the same URL — do I need different sizes? No. Using the same 80×80px PNG for every slot is fine. Microsoft scales it to fit whichever display context it needs. Separate sizes (16px, 32px, 80px) can improve crispness at small sizes if you want to provide them, but it’s not required.

I updated the image file at the same URL. Will Outlook pick it up automatically? Eventually, but Microsoft caches the icon for an unspecified period. If you need users to see the new image promptly, change the URL in the manifest (appending ?v=2 to the existing URL works), save the file, and re-upload it to Microsoft 365 admin center.

Can I use JPEG or GIF instead of PNG? PNG is the safest choice — it supports transparency, so the icon sits cleanly on any ribbon background color. JPEG and GIF generally work but JPEG lacks transparency support and GIF animation isn’t displayed.

I made a mistake in the XML and the manifest is invalid. What do I do? Download a fresh copy from the dashboard — the download always gives you the original unmodified file. Start the edit again from that clean copy.

Do I need to redo this every time the client gets a new manifest? Yes. If you re-download and re-upload a fresh manifest (for example, after an add-in update), it won’t include your icon edits. Keep a copy of your edited manifest so you can quickly re-apply the change when needed.

Related

• Report Phishing Button — deploy and configure the add-in.