Admin review for reported messages
The improved Microsoft 365 security center is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. Learn what's new.
The information in this article relates to a preview product that may be substantially modified before it's commercially released. This document is provided for evaluation and exploration purposes only.
In Microsoft 365 organizations with Exchange Online mailboxes and Microsoft Defender for Office 365, admins can now send templated messages back to end users after they review reported messages. This can be customized for your organization and based on your admin's verdict as well.
This feature is designed to give feedback to your users but does not change the verdicts of messages in the system. To help Microsoft update and improve its filters, you will need to submit messages for analysis using Admin submission.
You will only be able to mark and notify users of review results if the message was reported as a false positives or false negatives.
What do you need to know before you begin?
To modify the configuration for User submissions, you need to be a member of one of the following role groups:
You'll also need access to Exchange Online PowerShell. If the account that you're trying to use doesn't have access to Exchange Online PowerShell, you'll receive an error that says Specify an email address in your domain. For more information about enabling or disabling access to Exchange Online PowerShell, see the following topics:
Configure the messages used to notify users
In the Microsoft 365 Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Others section > User reported message settings.
On the User submissions page, if you want to specify the sender display name, check the box for Specify Office 365 email address to use as sender under the Email notifications for admin review results section, and enter in the name you wish to use. This is the email address that will be visible in Outlook and where replies will go to.
If you want to customize any of the templates, click Customize email notification. In this flyout, you will be able to customize only the following:
- No threats found
- Awareness training
When you're finished, click Save. To clear these values, click Discard on the User submissions page.