Skip to content
INFIMA Knowledge Base

Send reports from the user

Your ticketing system works out which client an email belongs to from the sender’s domain, but every report from the Report Phishing button arrives from phish-reports@infimasec.com, so each ticket needs sorting by hand. Turn on Send reports from the user and the button forwards each report from the reporting user’s own mailbox instead. The ticket then lands on the right company like any other email from that client.

You’ll need

Section titled “You’ll need”
  • The current Report Phishing button deployed for the client. See Moving a client off an older version if they’re on Version 3.
  • The client’s Microsoft 365 admin, to grant consent once. Clients that already granted it for Version 2 of the button are covered.

Walkthrough

Section titled “Walkthrough”

  1. Choose your default. In Settings → Phishing, under Report Phishing Button: Send Reports From the User, turn the toggle on and click Save if most of your clients should send reports from the user. It’s off unless you turn it on, and every client follows it unless you override it.

  2. Or turn it on for one client. Open the client → Tailor → Report Phishing Button. In Send reports from the user, flip the toggle and click Save. That client now overrides your default; Clear override (inherit) puts it back on your default.

  3. Grant consent. Under the toggle, Microsoft sign-in shows whether the button can sign in for this client. If it says Not seen yet or Failing, click Grant consent in Microsoft 365 and have the client’s Microsoft 365 admin approve the Report Phishing app. Users never see a prompt; this is a one-time admin approval.

The change applies to the next report. There’s nothing to redeploy in Microsoft 365.

You’ll know it worked when

Section titled “You’ll know it worked when”
  • Microsoft sign-in reads Working once a user has reported with the current button.
  • A real email reported from Outlook on the web, new Outlook, Mac or a phone reaches the report mailbox from the user’s own address, with a subject like 3| Suspected Phishing Email - <user email> - <date and time>. Junk reported with the categories manifest reads 3| Suspected Junk Email - ….
  • The forward isn’t kept in the user’s Sent Items.

Frequently asked

Section titled “Frequently asked”

Some reports still come from phish-reports@infimasec.com. Why? Reports fall back to our address, with the client’s name in the subject, whenever the button can’t send as the user:

  • Microsoft sign-in isn’t working yet for the client, or has stopped. Check Microsoft sign-in on the client’s page.
  • The user reported from classic Outlook for Windows. It can’t sign in on the user’s behalf, so its reports always come from our address.
  • The user still has Version 3 of the button, which never sends from the user. Upgrade the client to the current button.

Either way the report still reaches the security team, so nothing is lost.

Does this change anything for Version 2? No. Version 2 always sends reports from the user, whatever this setting says.

Does Microsoft Defender still get the report? Yes. Connecting Defender works the same whichever address the report comes from. See Microsoft Defender integration.

What about phishing tests and “Not junk”? Unchanged. Reporting one of our tests credits the user and isn’t forwarded to the security team, and Not junk is never forwarded.

Microsoft sign-in says Failing. What do I do? It worked before and has stopped, for example because the app’s approval was removed in the client’s Microsoft Entra. Ask the client’s Microsoft 365 admin to grant consent again with Grant consent in Microsoft 365. Reports keep arriving from our address meanwhile.

Section titled “Related”