Fix Microsoft Phishing Simulation Not Recording User Reports
Question details
Microsoft phishing simulations are failing to register emails reported by users via the Outlook Report Message add-in.
- Product
- Microsoft Outlook / Exchange
- Device & OS
- not provided
- Scenario
- An administrator is running an enterprise phishing simulation to track user reporting behavior and assign training.
- Observed behavior
- Simulation reports show zero reported emails and training emails are not delivered, despite multiple users successfully clicking the report button in Outlook 2016 and 2019.
Ensure you have Exchange Administrator or Security Administrator permissions to run a message trace and verify that the Report Message add-in is properly deployed to your users.
Run a Message Trace and Isolate Client Issues
Verify email delivery at the server level and rule out desktop client synchronization issues by testing the reporting feature directly in Outlook on the web.
Often, legacy desktop clients such as Outlook 2016 or 2019 can experience add-in syncing delays or cache issues that prevent security telemetry from reaching Microsoft 365 Defender immediately.
Log in to the Exchange Admin Center, navigate to Mail flow > Message trace, and enter the sender and recipient details for the simulated training email to see if it was blocked, filtered, or delivered.
Instruct the affected users to completely close their Outlook desktop applications and any mobile email clients connected to their accounts.
Have the user log into Outlook on the web (OWA), locate the simulated phishing email, and report it using the built-in web reporting tool.
Check the phishing simulation report in the Microsoft 365 Defender portal after a few minutes to see if the web-reported message was successfully recorded.
Need a Reliable and Lightweight Office Suite? Try WPS Office
While managing enterprise email security requires robust server-side tools, your daily document productivity shouldn't be complicated. WPS Office offers a free, highly compatible alternative to Microsoft Office for creating documents, spreadsheets, and presentations without heavy system resource usage.
Frequently Asked Questions
Why does the Report Message add-in work in Outlook on the web but not on the desktop?
Desktop clients like Outlook 2016 or 2019 may have outdated add-in caches, restricted local network policies blocking add-in telemetry, or delayed synchronization with Exchange servers, whereas the web version connects directly to the server.
How long does it take for a phishing simulation report to update in the portal?
Simulation reports can sometimes take a few minutes to a few hours to process and update in the Microsoft 365 Defender portal, depending on server load and your organization's mail flow rules.
What should I check if the simulated training emails are being blocked?
Review your Exchange mail flow rules and anti-spam policies. Ensure that the phishing simulation URLs, IP addresses, and sending domains are properly configured in your tenant's advanced delivery policies for phishing simulations.
