Microsoft 365 Phishing Reporting: Why the Report Button Needs a Real Response Workflow

Most small businesses tell employees to report suspicious email.

That is good advice, but it is incomplete.

If an employee reports a phishing email and nothing useful happens next, the business has not built a security workflow. It has built a button. The same problem applies to suspicious Microsoft Teams messages, scam calls, fake Microsoft 365 notices, invoice lures, QR-code phishing, and account-compromise warnings.

For small and midsize businesses, the practical question is not only, "Can employees report phishing?"

The better question is: when an employee reports something suspicious in Microsoft 365, who reviews it, how quickly is it triaged, what happens if it is real, and how does the employee know reporting mattered?

That question connects directly to email security, identity protection, business email compromise prevention, and buyer trust.

Why This Topic Is Timely

The keyword cluster behind this post is buyer-relevant: Microsoft 365 phishing reporting, Outlook report phishing button, Defender for Office 365 user submissions, Teams phishing reporting, Microsoft 365 email security workflow, business email compromise response, phishing triage for small business, user reported messages Microsoft Defender, and managed Microsoft 365 security.

This is not a vanity topic. It connects to the problems business owners actually care about:

• stopping account compromise before it spreads
• reducing invoice fraud and payroll diversion risk
• catching phishing messages that slipped through filtering
• helping employees make better decisions under pressure
• improving Microsoft 365 security without slowing normal work
• creating evidence that security alerts are reviewed
• building confidence that someone is watching the tenant

Microsoft's 2026 threat reporting shows why this matters. In the first quarter of 2026, Microsoft Threat Intelligence detected approximately 8.3 billion email-based phishing threats. Microsoft also reported that QR-code phishing more than doubled during the quarter, and that credential theft techniques continued evolving, including early signs of device-code phishing.

At the same time, Microsoft has been expanding reporting and submission workflows across Microsoft 365. Microsoft Learn documents user reported settings for Outlook, a User reported tab in the Defender portal, admin submission actions, user notification options, and reporting support for Teams messages and calls in organizations with Defender for Office 365 Plan 1 or Plan 2.

The direction is clear: phishing response is no longer only about blocking bad email at the gateway. It is about turning user suspicion into useful security signal across Outlook, Teams, Microsoft Defender, and the business process that follows.

The Business Problem: Employees Report Things, But No One Owns the Loop

Many small businesses have some version of a phishing-reporting process.

It may be a "Report Phishing" button in Outlook. It may be a shared mailbox such as phishing@ or support@. It may be an instruction to forward suspicious messages to IT. It may be part of a security awareness program. It may be handled by the MSP, the internal admin, or whoever happens to be available.

The weakness is often not the reporting method. The weakness is ownership.

Common gaps include:

• employees do not know whether to report or delete suspicious messages
• reports go to a mailbox no one reviews quickly
• reported messages are not submitted to Microsoft for analysis
• the reporting mailbox is not configured correctly
• users receive no feedback, so they stop reporting
• phishing simulations are mixed with real incidents
• reports are reviewed one at a time without checking who else received the same message
• finance and HR are not warned when a reported message involves payments or payroll
• account compromise indicators are missed after a user reports that they clicked
• Teams messages and calls are not included in the reporting workflow

That creates a trust problem. Employees may report the first few suspicious emails. If nothing comes back, they may assume reporting is pointless. Worse, they may start making their own decisions about what is safe.

A good phishing-reporting workflow does the opposite. It makes reporting easy, gives security or IT teams useful evidence, and closes the loop so employees learn what happened.

Why Reporting Still Matters When Microsoft 365 Has Filtering

Microsoft 365 email security can block a lot of malicious activity, especially when Exchange Online Protection, Defender for Office 365 policies, Safe Links, Safe Attachments, anti-phishing policies, impersonation protection, quarantine, and Zero-hour auto purge are configured well.

But filtering is not perfect.

Attackers keep changing lures, sender infrastructure, payloads, and social engineering tactics. Some messages contain no attachment. Some use QR codes in images or PDFs. Some impersonate vendors or executives. Some use compromised legitimate accounts. Some begin in Teams, a phone call, or a meeting invite instead of email. Some are designed to look like ordinary business process noise.

User reports help fill the gap between automated filtering and real business context.

An employee may notice that:

• a vendor's tone is wrong
• an invoice request does not match the normal approval process
• a Teams message came from an unexpected external contact
• a document link arrived outside the usual project channel
• a payroll change request seems unusual
• a Microsoft 365 sign-in prompt appeared after scanning a QR code
• a message asks for a device code, MFA approval, or password reset
• a customer replies to an email the employee did not send

Those are business-context signals. Security tools may not always know them. Employees often do.

The goal is not to make employees responsible for security analysis. The goal is to make it easy for them to raise their hand, then make sure someone competent reviews the signal.

What Microsoft 365 Reporting Can Do

Microsoft 365 includes several reporting paths that can support a practical small-business workflow.

In Outlook, organizations can use the built-in Report button or supported non-Microsoft reporting tools. Microsoft Defender user reported settings can send reported items to Microsoft, to a reporting mailbox, or to both, depending on configuration and tenant requirements.

In the Defender portal, admins can review user reported messages on the User reported tab of the Submissions page when user reported settings are enabled. Microsoft documents actions such as submitting reported messages to Microsoft for analysis, marking a verdict, notifying the reporting user, opening the email entity, taking actions, viewing alerts, and triggering investigations where licensing supports it.

For Microsoft Teams, Microsoft Learn says organizations with Defender for Office 365 Plan 1 or Plan 2, or Microsoft Defender XDR, can let users report Teams messages and calls. Users can report messages from chats, channels, and meeting conversations as malicious or non-malicious, and can report supported Teams calls from call history as scam or not scam.

That matters because phishing is no longer trapped in email.

If the business uses Teams for customer work, vendor communication, hiring, support, project coordination, or executive conversations, Teams reporting should be part of the same security process as Outlook reporting.

The Small Business Risk: A Report Can Be the First Sign of Compromise

A reported message is not always just a bad email.

Sometimes it is the first visible sign of a larger incident.

For example:

• An employee reports a Microsoft 365 login page after entering credentials.
• Finance reports a vendor bank-change message that came from a real vendor mailbox.
• A user reports a Teams message from a coworker that includes an unexpected file link.
• HR reports a payroll update request that references real employee details.
• A customer says they received a strange email from an employee's mailbox.
• A user reports that expected email is missing after suspicious sign-in activity.

Each of those reports should trigger a different level of response.

The business should not treat every report as a full incident. That would create noise and fatigue. But it should have clear rules for when a report becomes an account-compromise review, a payment-fraud review, or a broader Microsoft 365 investigation.

That is especially important for accounts tied to:

• owners and executives
• finance and payroll
• HR
• Microsoft 365 administrators
• sales and customer support
• shared mailboxes
• vendor management
• banking, insurance, legal, and tax workflows

If one of those users reports that they clicked, entered credentials, approved MFA, scanned a QR code, opened a suspicious attachment, or saw missing messages, the response should move quickly.

What a Real Phishing Reporting Workflow Should Include

Small businesses do not need a large security operations center to improve phishing response. They need a defined workflow that someone actually operates.

1. Make Reporting Easy in Outlook and Teams

Employees should not have to guess where suspicious messages go.

For most Microsoft 365 environments, the business should review whether the built-in Outlook Report button is enabled and whether Microsoft Teams reporting is available under the tenant's licensing. If a third-party phishing-reporting button is used, it should integrate cleanly with Microsoft Defender or the MSP's triage process.

The employee instruction should be simple:

• report suspicious email with the approved Outlook reporting button
• report suspicious Teams messages or calls where the feature is available
• do not forward suspicious messages casually to coworkers
• call IT or the help desk immediately if credentials, MFA, device codes, payments, or sensitive data may be involved

The last point matters. A report button is useful, but urgent compromise risk should not wait in a queue.

2. Decide Where Reports Go

Microsoft user reported settings allow reported messages to go to Microsoft, a reporting mailbox, or both, depending on the reporting method and environment.

For many SMBs, sending reports to both Microsoft and a monitored reporting mailbox can be useful. Microsoft analysis helps improve verdicts and detection. A reporting mailbox gives the business or MSP direct visibility into what employees are seeing.

But "both" only works if the mailbox is monitored.

If reports go only to a mailbox and no one submits them to Microsoft or reviews them promptly, the business may lose the value of the reporting pipeline. Microsoft documentation notes that reports sent only to the reporting mailbox appear as not submitted to Microsoft until an admin submits them.

The key decision is operational, not only technical:

• Who reviews reported messages?
• What is the expected response time?
• Who covers vacations, weekends, and after-hours emergencies?
• Which reports become tickets?
• Which reports become incidents?
• Who notifies users?
• Who informs finance, HR, leadership, or the MSP when business impact is possible?

3. Configure the Reporting Mailbox Correctly

If the business uses a reporting mailbox, it should be configured carefully.

Microsoft recommends identifying the reporting mailbox as a SecOps mailbox in the advanced delivery policy so user reported messages are delivered without being filtered. Microsoft also calls out this configuration as especially important when using phishing simulations or non-Microsoft phishing simulation tools.

This is the kind of detail small businesses often miss.

If the mailbox is treated like a normal mailbox, reports can be filtered, simulations can be mishandled, and the team may get an incomplete view. The reporting mailbox should also have an owner, access control, retention expectations, and a process for handling sensitive attachments or credentials that employees accidentally include.

4. Triage Reports by Risk, Not Just Volume

Not every reported message deserves the same response.

A practical triage process should sort reports into categories:

• obvious spam or junk
• false positive or legitimate message
• phishing attempt that did not appear to succeed
• phishing attempt sent to multiple employees
• possible account compromise
• possible business email compromise
• possible payment, payroll, HR, legal, or customer impact
• suspicious Teams message, call, or external collaboration request

High-risk reports should be escalated quickly. A phishing message sent to an intern may still matter, but a payment-change lure sent to finance or an MFA-related lure sent to an administrator deserves faster attention.

Use user tags, priority accounts, mailbox roles, department context, and business process knowledge where possible. The same message can have different risk depending on who received it.

5. Search for More Copies

When a real phishing message is reported, do not stop with that one mailbox.

Ask:

• Did other users receive the same message?
• Did anyone click?
• Did the message reach shared mailboxes?
• Was it sent internally from a compromised account?
• Did a similar Teams message or file link appear elsewhere?
• Did the sender domain or URL show up in other messages?
• Are there related quarantine, mail flow, or Defender events?

In Defender for Office 365, licensing affects how much investigation and hunting is available, but the principle applies at every level. One employee report can reveal a campaign.

If other copies exist, remove or quarantine them where possible, warn the right users, and document what happened.

6. Know When to Start Account-Compromise Response

If an employee only received and reported a suspicious message, the response may be limited.

If the employee clicked, entered credentials, approved an MFA prompt, scanned a QR code, shared a device code, downloaded a file, opened a malicious attachment, or replied with sensitive information, the response should expand.

A Microsoft 365 account-compromise review may include:

• reset or block the account where appropriate
• revoke sessions and refresh tokens
• review sign-in activity and unfamiliar locations
• inspect MFA methods for new or suspicious entries
• check inbox rules, forwarding, and mailbox delegation
• review OAuth app consent and connected apps
• search sent mail, deleted mail, and recoverable items where practical
• review Teams activity and file sharing
• check whether finance, HR, customers, or vendors were contacted
• verify whether payment instructions, payroll data, or customer information were exposed

This is where phishing reporting becomes identity protection. The report is the trigger. The response determines whether the business contains the risk.

7. Close the Loop With Employees

Employees are more likely to report suspicious messages when they know reports are reviewed.

Microsoft Defender supports admin actions such as marking a reported item with a verdict and notifying the reporting user. Even outside the exact Microsoft workflow, the business should decide how feedback works.

Useful feedback can be short:

• "Good catch. This was phishing, and we removed related messages."
• "This was legitimate, but reporting it was the right call."
• "This was spam. You can delete similar messages."
• "This involved a real vendor thread, so finance is verifying payment details."
• "Because credentials may have been entered, we reset the account and checked for mailbox changes."

The goal is not to write long explanations. The goal is to reinforce the habit and reduce uncertainty.

If users only hear from IT when they did something wrong, they will avoid reporting. If they hear that reporting helped, they become part of the defense.

Common Mistakes to Avoid

Small businesses often weaken phishing reporting without realizing it.

Avoid these mistakes:

• relying only on a shared mailbox that no one monitors
• letting users forward suspicious messages to coworkers for opinions
• treating every report as either "delete it" or "release it"
• failing to search for similar messages across the tenant
• ignoring Teams, calls, and collaboration channels
• forgetting to submit relevant messages to Microsoft when appropriate
• failing to distinguish phishing simulations from real threats
• not documenting business-impact decisions
• not warning finance or HR when the lure involves money or employee data
• not checking mailbox rules after possible account compromise
• not giving employees feedback after they report

The reporting workflow should reduce confusion, not add to it.

What Leadership Should Ask

This is a useful leadership-level control because it can be tested without deep technical knowledge.

Ask your IT provider or internal administrator:

• Is the Outlook Report button enabled for our users?
• Can users report suspicious Teams messages and calls where our licensing supports it?
• Where do user reports go?
• Who reviews reports and how quickly?
• Are reports submitted to Microsoft, reviewed internally, or both?
• Is the reporting mailbox configured as a SecOps mailbox if we use one?
• How do we handle reports from finance, HR, executives, and administrators?
• What happens if a user reports that they clicked or entered credentials?
• Do we search for other copies of confirmed phishing messages?
• Do employees receive feedback after reporting?
• How do phishing simulations fit into the workflow?
• What evidence can we show that reports are reviewed?

If those questions do not have clear answers, the business has an opportunity to improve quickly.

How CybarWorks Can Help

CybarWorks helps small and midsize businesses turn Microsoft 365 security features into practical operating processes.

That includes reviewing Outlook and Teams reporting settings, configuring Defender for Office 365 user reported settings, setting up or validating reporting mailbox handling, tuning anti-phishing policies, improving user feedback, reviewing account-compromise response steps, and connecting phishing triage to real business risks such as invoice fraud, payroll diversion, vendor impersonation, mailbox rule abuse, OAuth consent, and Microsoft 365 identity compromise.

If your business is not sure what happens after an employee clicks "Report phishing," CybarWorks can help build a clear workflow. The goal is simple: make suspicious activity easy to report, fast to review, and tied to action that protects the business.

Work Cited

• Microsoft Security Blog, Email threat landscape: Q1 2026 trends and insights
• Microsoft Learn, User reported settings
• Microsoft Learn, User reported settings in Microsoft Teams
• Microsoft Learn, Submit messages, URLs, and attachments for analysis in the Microsoft Defender portal
• Microsoft Docs, Defender for Office 365 what's new