Account Security Problems

Why Did I Receive an Automatic Microsoft 365 Security Notification?

Nimra Malik Oct 10, 2026 869 views

Question details

The user received an unexpected Microsoft 365 security notification mentioning email headers and questionable URLs, seemingly from a teammate who did not actually send the message.

Why Did I Receive an Automatic Microsoft 365 Security Notification?

Product: Microsoft 365
Device & OS: not provided
Scenario: Receiving a suspicious or unexpected automated security email regarding URL detection or user-submitted phishing reports.
Observed behavior: An automated message is delivered containing email headers and the text 'Questionable URLs detected in message: None', even though the named sender denies sending it.

Before you start

Before making any changes, do not click on any unrecognized links within the email itself, and ensure you have administrative access to your Microsoft 365 workspace if you plan to review organizational security settings.

Solution 1Recommended

Check Microsoft Defender User-Submission Settings

This notification is often triggered by automated routing when a user in your organization reports an email as phishing or junk.

In many Microsoft 365 environments, administrators configure Microsoft Defender to forward automated reports whenever a user clicks 'Report phishing' or 'Mark as not junk'. If you are unexpectedly receiving these, your email address might be designated as a report recipient.

Log into Microsoft Defender

Navigate to User Submission Settings

Go to the Security Settings page by directly visiting https://security.microsoft.com/securitysettings/userSubmission in your browser.

Review Designated Recipients

Check the report routing configuration to see if your email address is listed in the custom mailbox field for user submissions.

Confirm with the Teammate

Ask the teammate named in the notification if they recently used the report feature on a suspicious message, which would have triggered this automated alert.

Check Microsoft Defender User-Submission Settings

Configuration Update: If you are not the administrator and should not be receiving these alerts, you will need to contact your IT department to have your email address removed from the routing list.

Solution 2

Secure Your Account and Investigate Potential Misuse

If the teammate did not report an email and the notification seems entirely anomalous, the account may have been compromised.

Free Microsoft Office alternative

Looking for a secure and hassle-free Office suite? Try WPS Office.

If you are looking for a straightforward, lightweight, and highly secure alternative to Microsoft Office, WPS Office provides everything you need. It offers a familiar interface without complex administrative security overhead, keeping your offline workflow simple.

1. Download the Installer: Visit the official WPS website to download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the on-screen instructions to complete the setup.
3. Open Your Documents: Launch WPS Office and directly open your existing Microsoft Word, Excel, or PowerPoint files without losing any formatting.

Highly secure offline document processing without complex cloud configurations or confusing admin alerts.Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Lightweight design that runs smoothly on Windows, Mac, and Linux devices.Familiar user interface for a seamless migration from Microsoft 365.

microsoft office alternative - wps office

Frequently Asked Questions

What does 'Questionable URLs detected in message: None' mean?

This is a standard diagnostic output from Microsoft Defender indicating that its automated scanning tools reviewed the email headers and body but did not find any malicious or suspicious web links.

Why am I receiving security notifications meant for the IT admin?

Your email address might have been accidentally added to the Microsoft Defender user-submission settings as a designated recipient for phishing or junk email reports.

How do I stop these automated Microsoft 365 security emails?

A Microsoft 365 administrator needs to access the Microsoft Defender portal and remove your email address from the custom mailbox configuration under the user-submission settings.

Microsoft Office Security Issues