I occassionally receive a phishing email which disables the Report option only for itself in Outlook on the web

Question

I occassionally receive a phishing email which disables the Report option only for itself in Outlook on the web. My only option is to delete it but I would like to report it as phishing. What genius is able to do this? Can I enable the report button for this phishing email or am I just creating a potential security issue?

Answer 1

Hi @David Scarborough, 

Thank you for bringing this to attention.

It is understandable that the absence of the “Report” or “Report phishing” option on certain messages may raise concerns about the security and reliability of your Outlook experience.

However, please be assured that this behavior is not caused by the sender manipulating the Outlook on the web interface. Instead, it is typically related to how the reporting feature interacts with specific message properties or with reporting configurations applied within your organization’s tenant. As a result, the reporting button may be unavailable for some messages while remaining available for others.

To ensure a safe and effective resolution, please follow the recommended guidance below.

• Firstly, do not interact with the email content in any way, including clicking links or opening attachments.
• Secondly, use the standard reporting option whenever possible. If Report > Report phishing is available, please use it, as this helps improve threat detection and alerts the appropriate security teams.
  
• If the Report option is unavailable for a specific message, please use your organization’s approved alternative reporting method, such as Report It Now. This is the recommended approach when the standard reporting button is missing or not functioning correctly.
• After the message has been reported through the appropriate channel, please delete it from your inbox to reduce any further risk.

Furthermore, if this behavior occurs frequently or is reported by multiple users, it is strongly recommended to notify your IT or Security team promptly. They can then investigate and apply the necessary safeguards, which may include:

• Reviewing account security and determining whether protective actions, such as a temporary account lock, are required
• Analyzing sign-in logs and system activity for signs of unusual or suspicious behavior
• Performing a message trace in the Exchange Admin Center to identify how the email bypassed Exchange Online Protection or was processed via connectors
• Reviewing Microsoft Purview audit logs for unauthorized configuration changes or abnormal tenant activity
• Confirming whether mailbox spoofing was involved and applying corrective measures as needed

Most importantly, continued reporting of these messages is critical. When the built-in Report option is unavailable, using your organization’s approved secondary reporting method remains the safest and most effective action. Reporting an email does not create a security risk; on the contrary, it is strongly preferred over interacting with the message in any other way.

I hope the information I shared earlier was somewhat helpful in addressing your issue. If you have any further questions or updates, please don’t hesitate to share. I’m always happy to assist further if needed.   

Wishing you a wonderful day and continued well-being.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

In Outlook on the web, the built‑in Report button is only available when all of the following are true:

1. The organization has user reporting turned on.
2. The built‑in Report button is enabled in User reported settings.
3. The message is in a folder where that action is allowed (for example, junk can be reported as Not junk, inbox items as Junk or Phishing).

If any of these conditions are not met for a given message or mailbox, the Report option can be missing or unavailable, even if it appears for other messages. This behavior is controlled by tenant configuration and Outlook’s supported scenarios, not by the sender of the phishing email; the attacker cannot selectively disable the Report button inside the Outlook on the web UI.

For Outlook on the web in an organization:

• When the Report button is available and a message is reported as phishing, the message is deleted and, depending on admin configuration, is sent to the organization’s reporting mailbox, to Microsoft, or both.
• When the Report button is not available for a specific message, deleting the message is safe and does not create a security issue. The only downside is that the sample is not submitted through the built‑in reporting pipeline.

If reporting is important for the organization, an admin should:

1. Go to the User reported settings page in the Microsoft Defender portal (https://security.microsoft.com/securitysettings/userSubmission).
2. Ensure user reporting is turned on and the built‑in Report button is selected for Outlook on the web.
3. Verify that reported messages are configured to go to the desired reporting mailbox, to Microsoft, or both.

As an end user, if the Report button is missing for a particular phishing email in Outlook on the web, the safe options are:

• Delete the message from the mailbox.
• If allowed by the organization, use another supported Outlook client where the Report button is available (for example, Outlook for Microsoft 365 desktop or mobile) and report the same message from there.

This does not introduce a security risk; it only affects whether the message is submitted for analysis.

---

References:

• Report phishing and suspicious emails in Outlook for admins
• Use the built-in Report button in Outlook
• Protect yourself from phishing
• Phishing and suspicious behavior in Outlook