Topics Map > Campus Services > Office 365

Microsoft 365 - Report Suspicious message

This document describes how users can report a message as junk/phishing and help us improve campus junk mail filtering which were not flagged properly.

Note: UW–‍Madison staff and students periodically receive malicious messages from @wisc.edu senders. If you’ve recently received an email to your @wisc.edu account and are unsure whether it’s real or a scam, you can check it against this table. If you are still unsure whether the message is legitimate, please contact the Help Desk.

Important:

  • Before you submit a message as spam/phishing, you should verify if the message is spam/phishing or if it is actually graymail or bulk mail. Do not use Report Suspicious to report gray or bulk mail. To manage bulk mail, review How to prevent receiving graymail documentation.

  • The recommended method for reporting spam/phishing messages via any Microsoft Outlook client is to use the "Report Suspicious" link as described below. Do not use "Report", "Junk" or "Mark as junk" actions/features in any email client as this process will create an automatic rule within your account to deliver future emails from this specific "From" address to your 'Junk Email' folder - because most spam senders change their "From" address frequently, this additional step is usually not an effective way to block spam. Furthermore, there is a limit to the number of addresses that can be added to your Blocked Senders at which point the Blocked Senders tool will no longer function.

  • If you are reporting a message as suspicious on behalf of another account (an account you have full mailbox permissions to - say a service account), the report suspicious button/action will not work. You will need to follow steps outlined within the 'Non-Microsoft client' section below. 

To report a spam/phishing message that was not delivered to your Junk Email folder (click on the plus sign to expand the specific client section)

Outlook on the web

  1. Log into your Office 365 account via Outlook on the web.
  2. Select/open the message you would like to report as suspicious
  3. Within the message window, click "Report Suspicious" button:
    report suspicious action button

    Note: If the "Report Suspicious" action button does not appear, follow these steps to add this action to your message ribbon:

    1. At the top right corner within Outlook on the web, click the gear icon to open the Settings menu.

    2. Click on View all Outlook settings.

    3. In the Mail section, click on the Customize actions option.

    4. Scroll down within the customize actions page and place a check mark next to "Report Suspicious" setting.
      report suspicious selection within customize actions page

    5. Click Save.

  4. After a few seconds, the message will be processed and submitted to our system for analysis. It will also be moved to your "Deleted Items" folder. Click on Close button to complete the process.

Outlook for Windows/Mac desktop client

  1. Start Outlook.
  2. Select the message (preview pane enabled) or double-click to open in a new window.          
  3. Within the "Message" tab/ribbon, click "Report Suspicious" button (you may need to click on the ... ellipsis to see this button)

  4. report suspicious action button or MacOS report suspicious button

    Important: Do not use any other 'Report/Junk' action button other than the one above.

  5. After a few seconds, the message will be processed and submitted to our system for analysis. It will also be moved to your "Deleted Items" folder. Click Close button to complete the process.

Outlook for Android/iOS

  1. Start Outlook.
  2. Open the message and click the three dots (ellipsis) located next to the from address.
  3. Within the sub-menu, scroll down and click "Report Suspicious" button.
  4. After a few seconds, the message will be processed and submitted to our system for analysis  It will also be moved to your "Deleted Items" folder. Click Close button to complete the process.

Non-Microsoft client

The "Report Suspicious" add-in is only supported within modern Outlook clients. If you are using any non-Microsoft email client (e.g., Thunderbird, Apple Mail, Android/iOS native mail, etc.) or an older version of Outlook (2007/2010/2013), you will not see the "Report Suspicious" action button within the toolbar/ribbon. However, it is still possible to report the message as spam/phishing, so that UW-Madison's spam/phishing filtering system can adjust to catch similar messages in the future. To report a message as spam, forward the message to report-spam@doit.wisc.edu.

To report a message that has been misclassified as spam/phishing manually

Outlook on the web (do not use Outlook desktop client)

  1. Go to Outlook on the web
  2. Find the message in question and use the Outlook on the web instructions to forward the message as an attachment to report-not-spam@doit.wisc.edu address.
  3. Move the message to your desired folder.

What if I submitted a message as spam/phish by mistake

If you mistakenly submit a message as spam/phish by mistake, do not be concerned - just move the message back to your desired folder from your "Deleted Items" folder.

When a message is submitted as spam/phish using the instructions outlined above, there are processes in place where the message will still be reviewed by our spam scanning vendor to validate if the message is truly spam/phishing. One false submission will not cause the message to be flagged as spam in the future.

If you used Microsoft's spam submission action (and not the steps above), the same results exist, except one additional action should be reviewed/reset - you should review your block list to remove the block filter that was created.

See Also


Keywordsmicrosoft office365 o365 m365 microsoft 365 junk mail filter is-spam report-spam report-not-spam outlook web app for mac 2016 2019 on the web owa enterprise education filtering inbox submitting mark as spam marking reporting junkmail spammers spamming phishing filters blocking reporting spam emails messages personal information social engineering credentials netid password social security number ssn bank proofpoint proof point   Doc ID45051
OwnerO365 S.GroupMicrosoft 365
Created2014-11-17 14:04:02Updated2024-09-13 12:04:47
SitesDoIT Help Desk, Microsoft 365
Feedback  35   29