How to Report and Remove Phishing Emails in Microsoft 365
Question details
Organizations need a standardized process to report phishing emails, submit false negatives, block threats, and remove malicious emails from user mailboxes in Microsoft 365.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Migrating to Microsoft 365 and needing to manage phishing emails that occasionally bypass initial spam and malware filters.
- Observed behavior
- Phishing messages bypass Microsoft Defender, requiring administrators and users to manually report, block, and purge them from mailboxes.
Ensure you have Microsoft 365 administrator permissions, specifically access to Microsoft Defender and Exchange Online PowerShell, before attempting organization-wide email removal.
Report Phishing Messages as an End User
Users can report suspected phishing emails directly from their Outlook client to help Microsoft improve its filters.
End users play a crucial role in identifying phishing emails that slip through security filters. Reporting these messages helps your IT department and Microsoft block future attacks.
Open your Outlook inbox and click once on the suspicious email to select it without clicking any links inside.
Click the 'Report Message' or 'Report Phishing' button located on the Outlook ribbon at the top of the screen.
Click 'Report' in the confirmation dialog box to send a copy of the email data to your organization's IT admins and Microsoft for analysis.
Remove Phishing Emails Mailbox-Wide (For Admins)
Administrators can use Microsoft Defender for Office 365 to find and purge malicious emails across the entire tenant.
Submit False Negatives to Microsoft
Admins can submit emails that bypassed filtering directly to Microsoft for rule adjustments.
Enhance Your Productivity Safely with WPS Office
While Microsoft 365 handles complex enterprise email security, managing its steep costs and administrative overhead can be challenging. WPS Office offers a free, lightweight, and highly compatible alternative for your document productivity needs, allowing you to create, edit, and manage files seamlessly without the heavy subscription fees.
- 1. Visit the official website: Go to the official WPS Office website to access the latest secure version of the software.
- 2. Download the installer: Click the 'Free Download' button to download the lightweight installation file for your operating system.
- 3. Install and launch: Run the installer, follow the simple on-screen instructions, and open WPS Office to start working on your documents immediately.
Frequently Asked Questions
Why are phishing emails bypassing Microsoft Defender?
Phishing tactics constantly evolve. Attackers use sophisticated methods like compromised legitimate accounts, advanced spoofing, or novel malicious links that may temporarily evade Microsoft Defender's current filtering algorithms until they are reported and analyzed.
Can I automate the removal of phishing emails in Microsoft 365?
Yes, administrators can enable Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365. ZAP automatically detects and removes malicious messages even after they have been delivered to a user's inbox.
Do I need special permissions to delete emails from other users' mailboxes?
Yes, to search and delete messages across the Microsoft 365 tenant, you must be assigned appropriate administrator roles, such as Security Administrator, Organization Management, or specific eDiscovery permissions.
Can I use Exchange Online PowerShell to remove emails?
Yes, administrators can use the 'Search-Mailbox' or 'New-ComplianceSearch' and 'New-ComplianceSearchAction' cmdlets in Exchange Online PowerShell to bulk-delete phishing emails across the organization.
