HowTo: Configure CyberHoot’s Report Phish Integration for M365

Microsoft 365 Built-in “Report Phish” Integration

---

🔹Overview

Microsoft 365 supports a native Report button in Outlook that users click to report suspicious email. Admins can configure these reports to be delivered to a designated reporting mailbox.

This guide assists your organization in sending user reports to CyberHoot.

---

1️⃣ Access Microsoft Defender Portal

1. Open your browser and go to:
   👉https://security.microsoft.com
2. Sign in with an admin account that has one of these roles:
   ✔ Global Administrator
   ✔ Security Administrator
   ✔Exchange Administrator

---

2️⃣ Open User Reported Settings

You can get to the correct page either of two ways:

Option A — Navigate Manually

From the Defender portal:

1. Select System (gear icon ⚙️at bottom left)
2. Choose Settings, Email & collaboration
3. Click User reported settings(Microsoft Learn)

Option B — Use Direct Link

If you have permission, you can jump straight to the configuration page:

👉 https://security.microsoft.com/securitysettings/userSubmission (Microsoft Learn)

---

3️⃣ Turn on Monitoring of Reported Messages

On the User reported settings page:

1. Look at the top — find Monitor reported messages in Outlook
2. Check the boxto enable it.
   • If this setting isn’t enabled, the rest of the configuration won’t work.

---

4️⃣ Configure the Report Button

Below the Outlook settings:

1. Under Select an Outlook report button configuration, choose:
   Use the built-in Report button in Outlook
   • This ensures users see the native Report (flag/Phish) option in Outlook clients.

---

5️⃣ Choose Where Reported Messages Go

In the Reported message destinations select:

Option	Meaning
My reporting mailbox only	Sends reports only to your designated mailbox

---

6️⃣ Enter Your Reporting Mailbox

Below the destination choice:

1. In the field Add an Exchange Online mailbox to send reported messages to, enter your internal mailbox address (e.g., reportphish@yourdomain.com).
   • Only internal domain mailboxes are accepted here.
   • Microsoft will not let you enter an external domain directly at this step.
2. Click Save when done.

---

7️⃣ Verify the Report Button Works for Users

Have a test user perform these steps:

1. Open a suspected phishing email in Outlook (desktop or web).
2. Click Report → Report phishing.
3. Confirm the message is delivered to the reporting mailbox.
   • You can also check the User reported tab under Actions & submissions → Submissions in Defender (optional).(Microsoft Learn)

---

8️⃣ Forward Reports to CyberHoot

Microsoft 365 requires that user-reported messages be delivered to an internal Exchange Online mailbox. CyberHoot recommends using a dedicated reporting mailbox that securely relays reports to CyberHoot:

1. Create an internal mailbox (e.g., reportphish@yourdomain.com).
2. In Exchange Online, configure that mailbox to forward all received reports to your CyberHoot ingestion address.
   • Keep a copyin the internal mailbox if you want retention/audit.
   • This ensures only this mailbox has external referencing forwarding, not all users.

8️⃣.1️⃣ Allow External Forwarding for the Reporting Mailbox Only

Microsoft blocks automatic external forwarding by default.

You must enable it only for the reporting mailbox.

1. Go to:
   https://security.microsoft.com
2. Navigate to:
   Email & collaboration → Policies & rules → Threat policies → Anti-spam
3. Click:
   Anti-spam outbound policy (Default)
4. Click:
   Edit protection settings
5. Under Forwarding rules
6. Select On – Forwarding is enabled
7. Leave all the other settings to their Default

8️⃣.2️⃣ Configure Mailbox Forwarding in Exchange Admin Center

Now configure the reporting mailbox to forward to CyberHoot.

1. Go to:
   https://admin.exchange.microsoft.com
2. Navigate to:
   Recipients → Mailboxes
3. Select the mailbox:
   reportphish@yourdomain.com
4. Select:
   Mailflow settings
5. Click:
   Email forwarding
6. Toggle Forward all emails sent to this mailbox to On
7. Forward to:
   reportphish@cyberhoot.com
8. Enable:
   Deliver message to both forwarding address and mailbox
9. Click Save

📌
Result:
User-reported messages arrive in the internal mailbox and are automatically forwarded to CyberHoot.

8️⃣.3️⃣ Validate the Full Flow

1. Send a test phishing email to a user
2. User clicks Report phishing
3. Confirm:
   • Message arrives in the internal reporting mailbox
   • Message forwards to CyberHoot
   • The original email is preserved as a .emlattachment