Viewing & Reporting Phishing and suspicious Emails in Microsoft.

The Outlook Report button is one of the simplest ways to strengthen your organization's email security. When employees report a suspicious email instead of ignoring it, your security team spots threats sooner and a reporting habit takes hold. This guide shows how to turn the button on, what happens when someone uses it, and how to see what your employees reported, including Nimblr phishing simulations.

Why reporting matters

Employees take part in phishing defense. Reporting is an action they can take in a few seconds.
Your team sees threats sooner. Reported emails give your security team an early warning.
Protection improves over time. When reports go to Microsoft, Microsoft analyzes them, so user feedback helps improve detection.
Training and reporting work together. Employees practice reporting on Nimblr simulations, so they know what to do with a real one.

Nimblr simulations: if you have allowed Nimblr's simulations with the Advanced delivery policy, as described in Whitelist Simulations in Exchange Online, reported simulations are labeled as simulations in the Microsoft Defender portal. Microsoft also doesn't raise an alert, investigation or incident when an employee reports one with the built-in Report button. Your employees can practice reporting without creating extra work for your security team.

Turn on the Report button

Open User reported settings in the Microsoft Defender portal: security.microsoft.com/securitysettings/userSubmission. You can also go to Settings > Email & collaboration > User reported settings.
Select Monitor reported messages in Outlook, then select Use the built-in Report button in Outlook.
Set Send reported items to to Microsoft and my reporting mailbox, Microsoft only or My reporting mailbox only. If you want Microsoft to analyze and label the reports, choose one of the first two. Both work with the Nimblr Report Button integration.
Click Save.

The built-in Report button is available in the new Outlook for Windows, Outlook on the web, Outlook for Microsoft 365, and Outlook for Mac, iOS and Android. Older versions of Outlook may not have it. See Microsoft's list of supported Outlook versions.

Already use the Report Message or Report Phishing add-in? They still work with User reported settings, so you don't need to change anything.

What your employees do

They select the email, click Report, and then choose Report phishing or Report junk. Good to tell them what happens next:

Report phishing: the email is deleted.
Report junk: the email moves to the Junk Email folder and the sender is added to their Blocked Senders list.

Help your employees use it

Remind them to report anything that looks suspicious, real or simulated. Internal emails or security awareness posters help.
Tell them that false alarms are fine, and that reporting a simulation is exactly what you want.

See what your employees reported

Administrators can review reports in the Microsoft Defender portal, including reports of Nimblr simulations.

Before you start

Your mailboxes are in Exchange Online. The Submissions page is not available for organizations with only on-premises mailboxes.
Your account has at least the Security Reader role. Security Administrator also works.
The Report button is turned on, as described above.
Nimblr simulations are allowed with the Advanced delivery policy. This is how Microsoft recognizes a message as a simulation. If you use a reporting mailbox, it should also be registered as a SecOps mailbox in the Advanced delivery policy.

Open the reported messages

Open the Submissions page: security.microsoft.com/reportsubmission. You can also go to Actions & submissions > Submissions.
Select the User reported tab.
Click Filter, set a Start date and End date under Date reported, and click Apply. The list may open with a filter such as Last 7 days.
Review the list. Each row shows the subject and type of the reported email, who reported it, when, the sender, the reason for reporting, and the Result from Microsoft. Click Customize columns to add or remove columns, or Export to save the list as a CSV file.

Identify Nimblr simulations

Quick filter. Above the list, select Simulations to show only reported simulations. The number next to it is the count for the selected period.
Result column. Reported simulations show Phish simulation as the result.
Phish simulation filter and column. Click Filter and set Phish simulation to Yes. You can also add a Phish simulation column with Customize columns.
Report details. Click anywhere in a row, other than the check box, to open the details panel. The subject is at the top, and Phish simulation shows Yes under the reported message details. For simulations, the panel can show just a short set of email details: the network message ID, the sender and the sent date.

The Phish simulation label tells you that the message is a simulation. It doesn't say which product sent it. Nimblr simulations can also use sender addresses that look like real organizations, so don't use the sender to decide. To confirm that a message is from Nimblr, see How to identify if a suspicious email is a Nimblr simulation.

Good to know

Where reports are sent decides what Result shows. If Send reported items to includes Microsoft, Microsoft analyzes each report and shows its result. If it is My reporting mailbox only, every report shows Not submitted to Microsoft, so the Result column can't identify simulations.
Results can take a little while. Some results appear within minutes. Others can take up to a day.

Track the same reports in Nimblr

The Defender portal shows what Microsoft recorded. To see which employees reported Nimblr simulations in your Nimblr portal, connect the Report Button: Microsoft Report Button - Nimblr Integration.

Troubleshooting

Employees don't see the Report button. Check that Monitor reported messages in Outlook and Use the built-in Report button in Outlook are selected in User reported settings, and that they use a supported version of Outlook.
The list is empty or the Simulations count is 0. Check the date range, and check that employees reported with the built-in Report button or one of the Microsoft add-ins.
Every row shows Not submitted to Microsoft. Reported items are going to the reporting mailbox only. Change Send reported items to if you want Microsoft to analyze and label them.
Simulations don't show Phish simulation. Compare your Advanced delivery policy with Whitelist Simulations in Exchange Online: the sending domains, sending IPs and simulation URLs.

Learn more from Microsoft

Used well, the Report button is a low-effort, high-impact part of your security toolkit, especially alongside Nimblr's awareness training.

If you have any further questions, feedback or requests just reach out to us at: support@nimblrsecurity.com Or Submit a Ticket