Integrating the Microsoft Phishing Reporter Button with our Phishing Tool

- Key Benefits
- Steps to Set Up the Integration
- Possible Limitations

Dual Reporting: Emails reported via the Microsoft Phishing Reporting Button are sent to both Microsoft Defender and our Phishing Tool for advanced analysis.
Simulation Tracking: During phishing simulation campaigns, we track employees who report simulated phishing emails, helping administrators measure awareness and deliver targeted training.

If you don’t already have a shared inbox for phishing reports:

Forward reported phishing emails to us using a mail flow rule:

Please submit a request to our support team to get an email address for forwarding.
Log into the Microsoft 365 Admin Center and open the Exchange Admin Center.
Go to Mail Flow > Rules and click Create New Rule.
Configure the rule:
- Name: Enter a name such as "Forward Reported Emails to Living Security".
- Set Apply this rule if: Select the "The recipient" and then select the "is this person" option. Please enter the shared mailbox email address that you created in the previous section.
- Do the following: Select the "Add Recipients" and then select the "to the To box" option. Please enter the email address that you got from the Support Team.
Leave the "Except if" option as default and then click Next.
Leave the "Set rule settings" page settings as default and then click Next.
Click Finish to create the rule.

Open User Submission Settings in your Microsoft 365 portal.
Ensure “Monitor reported messages in Outlook” is active.
Choose “Use the built-in Report button in Outlook”.
Set “Reported message destinations” to “Microsoft and my reporting mailbox” or “My reporting mailbox only”.
Add your shared mailbox that you created at the beginning of the document to the "Add an exchange online mailbox to send reported messages to:" field and save.

If not already installed:

Step 5: Test the Integration

Launch a phishing simulation campaign.
Report a simulation email using the Microsoft Phishing Reporting button. Then, go to your campaign report and click the Reporters menu to verify that you reported the simulation email.
Verify the email is also visible on the Incident Responder page, if applicable.

Reporting Delays: When Microsoft forwards reported emails to the specified email destination, there may be a delay caused by Microsoft’s internal processing. For example, some emails may appear immediately whilst other emails may take 10 minutes to get reported to us from Microsoft.
Blocked Emails: Emails flagged as phishing might be quarantined by Microsoft or other security solutions, causing delays in forwarding.
Interference: External security solutions, such as Data Loss Prevention (DLP) systems, may interfere with email forwarding from Microsoft to our Phishing Tool. This can result in delays or prevent emails from being reported altogether.
Email Quarantine: Emails flagged as phishing might be quarantined by Microsoft or other security solutions, causing delays in forwarding.
Policy Conflicts: Custom email policies on the customer’s Microsoft tenant could block or redirect reported emails, affecting our tool's tracking.
Server Downtime: Temporary unavailability of Microsoft or our email servers can result in reporting delays.

This integration allows your organization to continue using Microsoft’s Phishing Reporting button while forwarding reports to our Phishing Tool for deeper analysis and tracking.