Fix User-Reported Phishing Messages Missing from Microsoft 365 Submissions
Question details
User-reported phishing emails are not appearing in the Microsoft 365 Submissions portal despite successfully arriving in the designated reporting mailbox.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- An administrator is attempting to review user-reported phishing messages but finds they are missing from the centralized Microsoft 365 Defender portal.
- Observed behavior
- Phishing messages successfully arrive in the designated reporting mailbox but fail to appear under Actions and submissions > Submissions > User reported.
Ensure you have the necessary Global Administrator or Security Administrator permissions in Microsoft 365 before modifying security and submission settings.
Verify User-Reported Settings and Mail Flow Rules
Check that your Microsoft 365 user-reported settings are correctly configured to send messages to the submissions portal.
If reported messages are bypassing the Submissions portal, the routing configuration might be set exclusively to a custom mailbox instead of Microsoft.
Log in to the Microsoft 365 Defender portal using your administrator credentials.
Go to Policies & rules > Threat policies > User reported settings in the navigation pane.
Ensure the setting is configured to send reported messages to Microsoft (or both Microsoft and the custom mailbox) so they appear in the portal.
Open the Exchange admin center and verify there are no active transport rules that might be modifying or bypassing the reporting headers.
Inspect Message Headers in the Reporting Mailbox
Verify that the reported emails contain the necessary headers to be recognized as user-reported submissions.
Contact Microsoft Support
If settings and headers are correct but messages are still missing, escalate the issue to Microsoft Support.
Looking for a Lightweight, Cost-Effective Office Suite?
While Microsoft 365 handles complex enterprise email and security policies, you might just need a reliable, fast, and lightweight tool for daily document work. WPS Office is a completely free, highly compatible alternative to Microsoft Office, offering an intuitive interface and seamless file handling without administrative overhead.
- 1. Visit the WPS Website: Navigate to the official WPS Office website on your computer.
- 2. Download the Installer: Click the 'Free Download' button to get the lightweight installation file.
- 3. Install and Start Creating: Run the installer, follow the simple on-screen instructions, and open WPS Office to immediately start working on your documents.
Frequently Asked Questions
Why are reported phishing messages going to a custom mailbox but not the Microsoft 365 submissions portal?
This usually happens if the user-reported settings in Microsoft 365 Defender are configured to send reports 'only to a custom mailbox' instead of sending them to Microsoft. You need to adjust the destination settings in the Threat policies to include Microsoft.
How long does it take for user-reported settings changes to apply?
After modifying the user-reported settings or mail flow rules in Microsoft 365, it can take up to 24 hours for the changes to fully replicate and take effect across your entire tenant.
Does the Outlook Report Message add-in work with third-party security tools?
Yes, while the add-in natively integrates with Microsoft 365 Submissions, administrators can configure mail flow rules to forward these user-reported messages to third-party SecOps tools or custom reporting mailboxes for external analysis.
