Report Phishing button

You want your client’s users to have one obvious way to report a suspicious email, wherever they read their mail. The Report Phishing button is an Outlook add-in for exactly that: on Windows, the web and Mac it sits where Outlook’s own Report button is, and on iPhone and Android it adds a Report Phishing button to the message. Every report gets an immediate answer telling the user what kind of email it was, and real reports reach the client’s security team.

Microsoft 365 clients only. The Report Phishing button isn’t currently available for Google Workspace.

Tailor Report Phishing Button page with the What we're seeing panel, the report destination mailbox, and additional recipients

You’ll need

Microsoft 365 admin access for the client, yours or theirs, to upload the manifest in Microsoft 365 admin center.
A mailbox for the client’s security team to receive reports: a shared mailbox, a security distribution list, or wherever they want reports to land. Optional but strongly recommended.

Choose a manifest

The client’s Tailor → Report Phishing Button page offers two downloads. They’re the same add-in; the only difference is what the user is asked when they click the button. Pick one per client.

	Standard	With report categories
Button label	Report Phishing	Report Message
What the user is asked	Whether to send the email to the security team	What kind of message it is: Phishing, Junk or Not junk
Best for	The simplest experience; every report is a phishing report	Security teams that want to know what was reported, or Defender clients who want submissions filed under the right category
What happens to the email	Moved to Deleted Items	Depends on the pick; see Report categories

Not sure? Start with Standard. You can switch a client later with Update on the existing app; see Switch between the two manifests.

Walkthrough

Set the destination mailbox. Open the client → Tailor → Report Phishing Button. Enter the mailbox that should receive reports and save. Add more addresses under Additional Recipients if reports should also reach a ticketing system or a SOC mailbox; each one gets its own copy.
Download the manifest. On the Report Phishing Button card, click Download manifest for the standard experience or Download manifest with categories. You get an XML file.
Upload it in Microsoft 365 admin center.
- Go to https://admin.microsoft.com → Settings → Integrated Apps.
- Click Upload custom apps.
- Choose Upload manifest file (.xml) from device and select the file you downloaded.
- Choose who gets it. Entire organization is recommended so every user has the button.
- Accept the permissions and finish.
- Allow up to 24 hours for Microsoft to roll the add-in out to users.
If the client already has Version 3 of our button, don’t upload a new app: choose Update on the existing one instead. See Moving a client off an older version.
(Optional) Decide who reports come from. By default, reports reach the security team from phish-reports@infimasec.com with the client’s name in the subject. If the client’s ticketing system matches clients by the sender’s domain, turn on Send reports from the user.

What the user sees

The answer the user gets the moment they report is where the training happens: they learn the difference between our tests and real phishing every time.

On Windows, the web and Mac, the user clicks Report Phishing where Outlook’s Report button usually is. Outlook asks “Send this email to your security team as suspected phishing?” with Report and Don’t Report, and a Don’t show me this message again checkbox. A user who ticks it skips the question next time; they still get the answer below.

On iPhone and Android, the user opens the email and taps Report Phishing. A short screen shows the sender and subject with a Report Phishing button.

What they’re told depends on the email:

One of our phishing tests: This was a simulated phishing test. It explains the email was a test from their organization, not a real attack, and that they’ve received credit for reporting it. The user shows as Reported in our phishing activity.
A real suspicious email: Email reported. The report goes to the security team and the email moves to Deleted Items.
One of our own emails, such as a training reminder: This email is safe. Nothing is reported or moved.

On a phone, the answer stays on screen until the user taps Done, which moves the email. A phone can only move emails, and recognize our own emails, once the client’s Microsoft 365 admin has granted consent. Without it, reports and phishing-test credit still go through, the email stays in the inbox, there’s no Done button, and one of our own emails may be reported like any other.

Report categories (optional)

Some security teams want to know what a user thinks they’re reporting, and Microsoft Defender files submissions under a category. For those clients, deploy the manifest with categories. Everything else about the deployment is the same.

The button reads Report Message, and the user is told “Your security team will review the messages you report” and asked What kind of message is it? On a phone the same choice appears on the report screen.

User picks	What happens to the email	Where the report goes
Phishing	Moved to Deleted Items	Report mailbox, our system, and Defender (as phishing) if connected
Junk	Moved to the Junk folder	Report mailbox with a `3\| Junk Reported by …` subject, our system, and Defender (as spam) if connected
Not junk	Stays where it is	Our system, and Defender (as not junk) if connected. Not forwarded to the report mailbox

Reporting one of our phishing tests as Phishing or Junk counts as Reported. Marking a test Not junk doesn’t count, since the user has judged it legitimate; they’re told Marked as not junk and the email stays put.

On Outlook for Mac the three choices may show as checkboxes. If a user ticks more than one, the most serious wins: phishing over junk, junk over not junk.

You’ll know it worked when

One of the client’s users sees Report Phishing (or Report Message) in Outlook. Allow up to 24 hours after deployment.
A test report from that user lands in the destination mailbox.
The What we’re seeing panel at the top of the client’s Report Phishing Button page shows Current, with the Outlook clients users reported from. It’s based on reports from the last 30 days, so it fills in once someone reports.

Moving a client off an older version

The What we’re seeing panel and the client’s Health page tell you when users still report with an older version of the button (Version 1, 2 or 3). Older versions keep working, but they miss things the current button does: phones on Version 3, report categories on Versions 1 and 2, and moving the reported email on Version 1.

From Version 3: download the manifest, then in Microsoft 365 admin center → Settings → Integrated Apps, select the existing Report Phishing app, choose Update, and upload the new file. It’s the same add-in, so there’s nothing to remove.
From Version 1 or 2: upload the new manifest as a new app (step 3 above), then remove the old app. Clients that granted Microsoft consent for Version 2 keep it.

We can’t see what’s deployed in Microsoft 365, only the reports users send. An older version keeps showing for 30 days after its last report, even once users report with the current button. After you replace it, choose Reset status on the What we’re seeing panel, and the status starts over from the next report. To reset every client at once, use Settings → Phishing → Report Phishing Button: Reset Status. If an older version is still installed somewhere, it shows up again the next time someone reports with it. Usually that’s a copy a user installed themselves or one deployed from the Exchange admin center, which removing the Integrated Apps deployment doesn’t remove.

Switch between the two manifests

The standard and categories manifests are the same add-in, so switching is an update, not a reinstall:

Download the manifest you want from the client’s Report Phishing Button page.
In Microsoft 365 admin center → Settings → Integrated Apps, select the existing Report Phishing app.
Choose Update (not Upload custom apps) and upload the file.

Users see the change once Outlook picks it up, which can take up to 24 hours. Uploading the other manifest as a new app would give users two report buttons.

To remove the button entirely: in Settings → Integrated Apps, select the Report Phishing app and choose Remove app.

Frequently asked

Do I need to do this for every Microsoft 365 client? Yes. The mailbox and the manifest are both per client, because each client has its own Microsoft 365. Once deployed, users see the button within 24 hours.

Which Outlook versions are supported? Outlook on the web, new Outlook for Windows, classic Outlook for Windows (Version 2404, build 17530.15000 or later), Outlook for Mac (16.100 or later), and Outlook for iPhone and Android.

My client is on Google Workspace. What’s the equivalent? There isn’t one yet. The Report Phishing button isn’t currently available for Google Workspace. Reports made with Gmail’s built-in Report phishing option don’t reach us, so a reported phishing test needs Mark as Reported. See A user got a click reminder but says they didn’t click.

A user reported one of our phishing tests. Does that count as “reported”? Yes. Reporting our test is the right action: the user shows as Reported and is told on the spot that it was a test and that they got credit.

A user reported a real phishing email. What happens next? The report reaches the destination mailbox and any additional recipients for the security team to investigate, goes to Defender if you’ve connected it, and shows in the user’s phishing history.

A user reported a legitimate email by mistake. Is that a problem? No. The email is in their Deleted Items, where they can get it back. If it happens often, the manifest with categories gives users a Not junk choice that leaves the email where it is.

The reports all come from phish-reports@infimasec.com. How do we tell which user reported? The reporting user is in the subject and the body: 3| Phishing Reported by <user email> from <sender> [<client name>]. If you’d rather reports come from the user’s own address, turn on Send reports from the user.

We send reports into our PSA. Can each ticket land on the right company? Yes. Reports from phish-reports@infimasec.com end with the client’s name in brackets, such as [Acme Corp], so a mail connector or ticket rule can assign them. If your PSA matches companies by sender domain instead, turn on Send reports from the user.

Do users have to sign in or approve anything? No. Users never see a sign-in or consent prompt from the button, on any version. Microsoft consent is granted once by the client’s Microsoft 365 admin, and only matters for sending reports from the user and for phones.

The button isn’t showing up for users. What do I check?

Allow up to 24 hours after deployment.
In Microsoft 365 admin center, check the app was deployed to those users; deployments can be limited to groups.
On classic Outlook for Windows, check the user is on Version 2404 (build 17530.15000) or later.
Have them restart Outlook.

The client’s page says “No reports yet”. Is the button missing? Not necessarily. The panel is built from reports made in the last 30 days, so a client whose users haven’t reported anything recently shows nothing, even with the button installed.

How do reports work with Microsoft Defender or other security tools? For Defender, connect the built-in integration on the same page and every real report is submitted to the client’s Defender automatically. See Microsoft Defender integration. For other tools, point them at the destination mailbox.

Send reports from the user: have reports come from the reporting user’s own address.
Microsoft Defender integration: submit reports straight to the client’s Defender.
Customize the Report Phishing Button icon: use the client’s own icon.
Tailor to your client: the button is one of the Tailor steps after onboarding.