> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outkept.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Outlook report button

> Route Outlook's built-in Report Phishing button through to OutKept.

If your organisation cannot deploy the OutKept add-in, whether due to compatibility issues or
by choice, you can use our integration with Outlook's built-in **Report Phishing** button
instead.

With this setup:

* All reports, including OutKept simulations, are centralised in a single inbox.
* All reported phishing simulations are tracked in our platform statistics.
* Users who report emails automatically receive feedback.

<Warning>
  Microsoft changed the integration requirements for the Outlook Report Phishing button, so
  configurations made before that change are no longer valid and may stop phishing emails
  being reported correctly. If you set this up previously, work through the steps again.
</Warning>

## Create a shared mailbox for reported emails

<Steps>
  <Step title="Add the mailbox">
    Go to [admin.microsoft.com](https://admin.microsoft.com), open **Teams & groups** then
    **Shared mailboxes**, and click **Add a shared mailbox**.

    Give it a name that uniquely identifies it, for example `phishing`, with an address such
    as `phishing@your-domain`.
  </Step>

  <Step title="Register it as a SecOps mailbox">
    This tells Microsoft not to quarantine or filter the forwarded mail. Go to
    [the SecOps mailbox settings](https://security.microsoft.com/advanceddelivery?viewid=SecOpsMailbox),
    click **Add**, or **Edit** if a SecOps mailbox already exists.
  </Step>

  <Step title="Select and save">
    Search for and select the shared mailbox you just created, then click **Save**.
  </Step>
</Steps>

<Warning>
  Do not skip the SecOps step. Without it, reported mail can be quarantined before it reaches
  the shared mailbox, and reports silently go missing.
</Warning>

## Configure the Outlook Report phishing button

Now point Microsoft's own button at that shared mailbox.

<Steps>
  <Step title="Open user reported settings">
    Go to Microsoft Defender and navigate to **Settings** → **Email & Collaboration** → **User
    reported settings**.
  </Step>

  <Step title="Set the required options">
    Many settings here are optional and can follow your own company policy. These are the ones
    that matter:

    | Setting | Value |
    | - | - |
    | Monitor reported messages in Outlook | Ticked |
    | Select an Outlook report button configuration | Use the built-in Report button in Outlook |
    | Reported message destinations | My reporting mailbox only |
    | Add an Exchange Online mailbox to send reported messages to | The shared mailbox you created above |
  </Step>

  <Step title="Save">
    Click **Save**.
  </Step>
</Steps>

## Set up a forwarding rule

This sends a copy of everything reaching the shared mailbox to our reporting address, which
is what lets users get feedback on their reports.

Create the rule in the Exchange admin center, under **Mail flow** then **Rules**, and fill in
the three fields as follows.

| Field | Set it to |
| - | - |
| **Apply this rule if** | **The recipient** then **is this person**, and enter the shared mailbox you created above |
| **Do the following** | **Add recipients** then **to the Bcc box**, and enter `phishing@outkept.report` |
| **Except if** | **The sender** then **is this person**, and enter `forward@outkept-reporting.com` |

<Warning>
  The exception is not optional. Without it, mail arriving from our reporting address is
  copied straight back to us and the rule loops.
</Warning>

### Enable external forwarding

External forwarding has to be allowed for that rule to work.

<Steps>
  <Step title="Create an outbound policy">
    Go to [the anti-spam settings](https://security.microsoft.com/antispam), click **Create
    policy** and select **Outbound**.
  </Step>

  <Step title="Name and scope it">
    Fill in the **Name** field with `OutKept reporting forward` and click next. Enter the shared
    mailbox account in the **Users** field and click next.
  </Step>

  <Step title="Set the forwarding options">
    | Field | Value |
    | - | - |
    | Restriction placed on users who reach the message limit | No action, alert only |
    | Automatic forwarding rules | On - Forwarding is enabled |
  </Step>

  <Step title="Save">
    Click **Next**, then **Save**.
  </Step>
</Steps>

## Then what

All reported emails, both OutKept mail and everything else, can now be viewed in the shared
mailbox. Reported simulations appear on the dashboard under **Reported emails**. See
[Dashboard](/campaign-dashboard).

Tell people the button now goes somewhere. See
[Tell people about it](/reporting-overview#tell-people-about-it).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.