Microsoft 365 - Report Suspicious message
Before you submit a message as spam/phishing, you should verify if the message is actually spam/phishing or graymail. To manage mail that is not spam/phishing, review the junk email and phishing documentation.
The recommended method for reporting spam/phishing messages via any Microsoft Outlook client is to use the "Report Suspicious" link as described below. Do not use "Report", "Junk" or "Mark as junk" actions/features in any email client as this process will create an automatic rule within your account to deliver future emails from this specific "From" address to your 'Junk Email' folder - because most spam senders change their "From" address frequently, this additional step is usually not an effective way to block spam. Furthermore, there is a limit to the number of addresses that can be added to your Blocked Senders at which point the Blocked Senders tool will no longer function.
- If you are reporting a message as suspicious on behalf of another account (an account you have full mailbox permissions to - say a service account), the report suspicious button/action will not work. You will need to follow steps outlined within the 'Non-Microsoft client' section below.
To report a spam/phishing message that was not delivered to your Junk Email folder (click on the plus sign to expand the specific client section)
Outlook on the web
- Log into your Office 365 account via Outlook on the web.
- Select/open the message you would like to report as suspicious
- Within the message window, click "Report Suspicious" button:
Note: If the "Report Suspicious" action button does not appear, follow these steps to add this action to your message ribbon:
At the top right corner within Outlook on the web, click the gear icon to open the Settings menu.
Click on View all Outlook settings.
In the Mail section, click on the Customize actions option.
Scroll down within the customize actions page and place a check mark next to "Report Suspicious" setting.
After a few seconds, the message will be processed and submitted to our system for analysis. It will also be moved to your "Deleted Items" folder. Click on Close button to complete the process.
Outlook for Windows/Mac desktop client
- Start Outlook.
- Select the message or double-click to open in a new window.
- Within the "Message" tab/ribbon, click "Report Suspicious" button (you may need to click on the ... ellipsis to see this button)
orImportant: Do not use any other 'Report/Junk' action button other than the one above.
- After a few seconds, the message will be processed and submitted to our system for analysis. It will also be moved to your "Deleted Items" folder. Click Close button to complete the process.
Outlook for Android/iOS
- Start Outlook.
- Open the message and click the three dots (ellipsis) located next to the from address.
- Within the sub-menu, scroll down and click "Report Suspicious" button.
- After a few seconds, the message will be processed and submitted to our system for analysis It will also be moved to your "Deleted Items" folder. Click Close button to complete the process.
Outlook on the web (do not use Outlook desktop client)
- Go to Outlook on the web
- Find the message in question and use the Outlook on the web instructions to forward the message as an attachment to email@example.com address.
- Move the message to your desired folder.
If you mistakenly submit a message as spam/phish by mistake, do not be concerned - just move the message back to your desired folder from your "Deleted Items" folder.
When a message is submitted as spam/phish using the instructions outlined above, there are processes in place where the message will still be reviewed by our spam scanning vendor to validate if the message is truly spam/phishing. One false submission will not cause the message to be flagged as spam in the future.
If you used Microsoft's spam submission action (and not the steps above), the same results exist, except one additional action should be reviewed/reset - you should review your block list to remove the block filter that was created.