How can I turn off the "Results on the email you reported as Phish" notification?

Question

Lately, when users have been reporting phishing emails using the integrated Report Button in Outlook, they have promptly been receiving a message from *** Email address is removed for privacy *** that states the message is clean when in fact the message is malicious causing users to click the link. I am assuming this is because defender has only performed a quick scan and has not finished the deep analysis yet. I really want to turn this notification message off but cannot find anywhere to do so. This is directly causing a security risk. I also don't see the need for a user to get this instant feedback since they are already suspicious of the email. If we could turn this off, worst case scenario would be they report the message but then think it was in fact safe and request it to be released. That way we can look at it before we release it.

Answer 1

Hi @Trent Greenough,

Thank you for posting your question in the Microsoft Q&A forum.

I understand how receiving an immediate “clean” notification after reporting a phishing email can create confusion and even pose a security risk if users assume the message is safe.

Currently, these notifications are part of the Alert policy feature in Microsoft Defender for Office 365. When a user reports an email using the built-in Report Message or Report Phishing button, the system sends an automated response based on the initial verdict (e.g., no threat found, spam, phishing, or malware). This is designed to provide transparency and user education, but as you noted, it can sometimes lead to unintended behavior if the verdict changes after deeper analysis.

You can disable it, below is how to do it:

1. Sign in to Microsoft 365 Defender portal.
2. Choose Email & collaboration > Policies & rules > Alert policy
3. Search for "Email reported by user as malware or phish" and click on it
4. You can turn it off by click on the switch button next to "Status"

For reference, you can see: Alert policies in Exchange Online

Please understand that our initial response does not always resolve the issue immediately. However, with your help and more detailed information, we can work together to find a solution. 

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this. 

Thank you for your patience and your understanding. If you have any questions, please feel free to reach out. 

I'm looking forward to your reply. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.