Others

Fix Microsoft Defender Report Replies Going to the Wrong User

Huma Ashraf Ch Sep 28, 2026 869 views

Question details

The user needs to correct the routing of Microsoft Defender user submission notifications so they are sent to the original submitter rather than the support analyst.

Fix Microsoft Defender Report Replies Going to the Wrong User

Product: Microsoft Defender
Device & OS: not provided
Scenario: Managing user submissions and notifications in Microsoft Defender.
Observed behavior: User submission notifications are incorrectly sent to support analysts even when notification settings remain unchanged.

Before you start

Ensure you have global administrator or security administrator privileges in your Microsoft 365 tenant to access and modify Microsoft Defender submission configurations.

Solution 1Recommended

Verify Configuration and Escalate to Microsoft Support

Since this is often a backend routing behavior, reviewing your settings and documenting the issue for official support is the most effective approach.

Microsoft Defender backend routing issues can occasionally cause notifications to bypass configured settings. Verifying your current configuration and collecting detailed logs will streamline the escalation process with Microsoft.

Check Submission Portal Settings

Log in to the Microsoft 365 Defender portal and navigate to the User submissions settings to verify that notification preferences haven't been inadvertently modified.

Document the Incident

Record the specific submission IDs, timestamps, the name of the affected analysts receiving the emails, and the intended original submitters.

Submit a Support Request

Go to the Microsoft 365 admin center, access the Support section, and create a new service request including your documented evidence.

Engage the Community Forum

Alternatively, post your detailed issue in the Microsoft Defender for Cloud Apps Q&A forum for insights from specialized advanced users.

Verify Configuration and Escalate to Microsoft Support

Backend Behavior: This specific routing failure often requires Microsoft engineers to investigate tenant-side synchronization or backend policy enforcement.

Free Microsoft Office alternative

Looking for a Lightweight and Compatible Office Suite?

While you manage your organization's Microsoft Defender settings, consider WPS Office as a free, lightweight, and highly compatible alternative to Microsoft Office for your daily document productivity.

1. Download and Install: Visit the official WPS website to download the free installer for your operating system.
2. Open Existing Files: Double-click any Microsoft Word, Excel, or PowerPoint document to open it directly in WPS Office without conversion.
3. Work in a Familiar UI: Utilize the classic tabbed ribbon interface to easily find all the formatting and editing tools you are used to.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight design ensures fast launch times and smooth performance.Free to use with a familiar, easy-to-navigate tabbed interface.Seamlessly migrate your existing workflow without compatibility issues.

microsoft office alternative - wps office

Frequently Asked Questions

Why did my Microsoft Defender notification settings suddenly change?

Notification routing behaviors can sometimes be affected by backend system updates or policy synchronization delays within Microsoft 365, even if no manual changes were made to the tenant settings.

Where can I find the user submission settings in Microsoft Defender?

You can access these settings by logging into the Microsoft 365 Defender portal, navigating to Policies & rules, selecting Threat policies, and then clicking on User submissions.

Can I customize the email notifications sent to users who report messages?

Yes, administrators can customize the organization's user submission email notifications, including the sender display name, logo, and the specific text shown to users when they report an email.

What should I include when opening a support ticket for incorrect notifications?

Always include the message trace details, submission IDs, dates of occurrence, the incorrect recipient's email address (analyst), and the expected recipient's email address (original submitter).

Office Quick Solutions