How to Report Phishing Emails in Outlook: A Step-by-Step Guide

Despite years of awareness training, phishing remains the most successful initial access vector for ransomware, business email compromise (BEC), and credential theft. In real-world incident response, it’s rare to see a major breach that didn’t begin with a deceptive email.

Outlook—used by hundreds of millions globally—is often the front line. Microsoft has invested heavily in phishing detection through Defender for Office 365, but human reporting remains one of the most effective detection signals.

This guide goes beyond “click here to report phishing” and explains:

• How reporting actually helps Microsoft and your SOC
• The correct reporting method per Outlook platform
• What happens after you click “Report Phishing”
• How IT teams should operationalise user reporting

Why Reporting Phishing Emails Actually Matters

From an IT and security operations perspective, reporting phishing emails provides three major benefits:

1. Improves Microsoft’s Global Detection Models

Every reported phishing message feeds into Microsoft’s machine-learning systems. This directly improves:

• Spam and phishing filters
• Safe Links and Safe Attachments detection
• Zero-hour auto purge (ZAP) accuracy

2. Enables Faster Internal Incident Response

In Microsoft 365 tenants, reported emails can:

• Trigger automated investigations
• Alert SOC teams via Defender
• Enable tenant-wide message removal

3. Reduces “Silent Failures”

Users who delete phishing emails without reporting them:

• Prevent security teams from seeing trends
• Allow campaigns to continue undetected
• Increase dwell time for attackers

From experience:
Most phishing incidents that escalate are the ones no one reports.

Identifying a Phishing Email (What Users Often Miss)

Even experienced users can be fooled. Some modern phishing campaigns include:

• Perfect spelling and branding
• Legitimate Microsoft login pages hosted on compromised domains
• QR codes to bypass URL scanning
• HTML attachments masquerading as invoices

Red flags IT teams should educate users on:

• Urgent language (“Act now”, “Account suspended”)
• Unexpected MFA prompts
• External sender spoofing internal teams
• Attachments requiring login to view

How to Report Phishing Emails in Outlook (Desktop App)

Supported Versions

• Outlook for Microsoft 365 (Windows & macOS)
• Outlook 2019 / 2021 (with add-in)

Step-by-Step

1. Select the suspicious email
   Do not click links or open attachments.
2. Click the “Report” or “Report Message” button
   Located on the Outlook ribbon (may appear under “More actions”).
3. Choose “Phishing”
   Options typically include:
   • Junk
   • Phishing
   • Not Junk
4. Submit the report
   The message is:
   • Sent to Microsoft for analysis
   • Moved to the Junk Email folder

Behind the Scenes

• Headers and body are analysed
• URLs are detonated in Microsoft sandboxes
• Campaign correlation begins across tenants

How to Report Phishing Emails in Outlook on the Web (OWA)

For Outlook on the Web (outlook.office.com):

1. Select the email (checkbox or open message)
2. Click More actions (⋯) in the toolbar
3. Choose Report → Phishing
4. Confirm the action

This method is fully integrated with Microsoft Defender for Office 365 and is preferred for cloud-first tenants.

Reporting Phishing in the Outlook Mobile App (iOS & Android)

Mobile phishing is rising fast—especially SMS-style invoice and voicemail lures.

Steps:

1. Open the phishing email
2. Tap the three-dot menu
3. Select Report Junk or Report Phishing
4. Confirm submission

Important:
Mobile reporting is often overlooked, yet many credential theft attacks succeed via mobile devices where users are less cautious.

The Microsoft Report Message Add-In (Enterprise Best Practice)

What It Is

The Report Message Add-in is the preferred enterprise reporting mechanism for Microsoft 365 tenants.

Why IT Teams Should Deploy It

• Standardised reporting experience
• Central visibility for SOC teams
• Integration with Defender investigations
• Supports “Not Junk” feedback (critical for tuning)

Deployment Options

• Microsoft 365 Admin Center
• Centralised Deployment
• Intune / Endpoint Manager

Once deployed, users see a Report Message button directly in Outlook.

What Happens After a User Reports Phishing?

From an operational standpoint, reporting triggers:

1. Automated threat analysis
2. Campaign correlation
3. Potential tenant-wide purge
4. Defender alerts and investigations
5. Improved filtering for future emails

In mature environments, this integrates with:

• SOC playbooks
• SIEM ingestion
• Incident response workflows

What Users Should Do If They Clicked a Phishing Link

This is where real-world guidance matters.

Immediate actions:

• Disconnect from the network (if possible)
• Change affected passwords
• Revoke active sessions
• Check MFA sign-ins
• Run endpoint scans

IT teams should:

• Force password reset
• Review Azure AD sign-in logs
• Check mailbox rules (common persistence method)
• Investigate lateral movement

Common Mistakes IT Teams See Repeatedly

❌ Telling users to forward phishing emails manually
❌ Using shared mailboxes as reporting mechanisms
❌ Not training users on mobile reporting
❌ Ignoring “false positive” feedback
❌ Treating phishing as a user problem instead of a process problem

Best Practices for Organisations

1. Train users how and why to report
2. Deploy the Report Message Add-in
3. Monitor reporting metrics
4. Automate response where possible
5. Reward reporting behaviour

Security culture insight:
Users who report phishing early are one of your strongest security controls.

Reporting Is a Security Control, Not a Courtesy

Reporting phishing emails in Outlook isn’t just a user hygiene task—it’s a critical detection and response mechanism that directly impacts your organisation’s security posture.

When done correctly, reporting:

• Reduces attacker dwell time
• Improves Microsoft’s detection accuracy
• Enables faster SOC response
• Protects other users globally

For IT professionals, the goal isn’t just teaching how to report phishing—but embedding it into daily operational security.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.