Microsoft Report Button - Nimblr Integration

Connecting your Microsoft Report Button with Nimblr will allow the Administrators & Group Auditors to track and display in your portal which users are in fact reporting the Nimblr Phishing Simulations or not.

So how does the Report Button integration work?

When a user clicks the Microsoft “Report” button:

• Microsoft sends a copy of the reported email to a shared mailbox that you configure.
• Nimblr does not access user mailboxes.
• Nimblr only reads emails that exist inside the dedicated shared mailbox.
• Nimblr analyzes whether the reported message matches an active phishing simulation.
• The user receives an email notification with positive feedback after successfully reporting a Nimblr simulation
• The result is displayed in the Nimblr portal for reporting and tracking purposes.
  
  

Create a new shared mailbox

1. Go to: https://admin.cloud.microsoft/?#/SharedMailbox and create a new shared mailbox.
   
   

2. Go to: https://security.microsoft.com/securitysettings/userSubmission and set “Send reported items to:” > “Microsoft and my reporting” mailbox
   
   

3. Select the shared mailbox you just created.
   
   
   
   

In the Customize messages you can choose to customize the message the user receives after reporting the email.

Click on Customize messages then Add Customized message  and choose the option   Phishing Reported and then fill in Title & Description.

Create and configure a New App Registration

Why is this needed?

The integration uses:

• Microsoft Graph
• Application permission: Mail.Read

Application permissions are required because:

• The shared mailbox is not tied to a single signed-in user session.
• The integration runs as a background service.

Delegated permissions require a logged-in user context and are therefore not
suitable for automated processing of a shared mailbox.

1. Go to: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

2. Then create a new app registration
   
   

3. Go to API permissions, click: Add a permission, and select Microsoft Graph.
   
   
   
   
   

4. Choose: Application permissions,select Mail.Read and click Add permissions
   
   
   
   
   

5. Go to Certificates and secrets and create a new secret
   
   
   
   
   
   

6. Copy the Value (Not the secret ID) and paste it in a text document for later
   
   
   
   

7. Go to Overview and copy: Application (client) ID and Directory (tenant) ID in the same document as the Client secret
   
   
   

Limiting the permissions 

Nimblr strongly advocates for the principle of least privilege. Assigning accounts only the minimum permissions necessary to perform their tasks helps reduce security risks and strengthens your organization's overall protection.

By default, Mail.Read (Application) technically grants the ability to read all mailboxes in the tenant.

However:

•  Nimblr only queries the specific shared mailbox configured
•  No logic exists to enumerate or access other mailboxes
  
  

What this does:

• The app can only access mailboxes inside that security group
• If it tries to access any other mailbox, access is denied by Exchange Online
• Enforcement is handled by Microsoft’s backend

Set up group & policy:

• Open up PowerShell

Run the following command to sign in:

Create a new distribution group:

Add the policy:

Configure in the Nimblr Portal

1. Go to Settings tab > Report Button 
   
   

2. Fill in the following credentials: Application (client) ID, Directory (tenant) ID and Client secret
   
   
    

3. Select the mailbox you created in step 1.

4. Now it's Done!           

Allow up to 48 hours for the policy to take effect. 

  If you have any further questions, feedback or requests just reach out to us at:                                                    support@nimblrsecurity.com
                                                                   Or
                                                        Submit a Ticket