Report false positives and false negatives in Outlook

Tip

Did you know you can try the features in Microsoft 365 Defender for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft 365 Defender portal trials hub. Learn about who can sign up and trial terms here.

Applies to

Note

If you're an admin in a Microsoft 365 organization with Exchange Online mailboxes, we recommend that you use the Submissions page in the Microsoft 365 Defender portal. For more information, see Use the Submissions portal to submit suspected spam, phish, URLs, and files to Microsoft.

In Microsoft 365 organizations with mailboxes in Exchange Online or on-premises mailboxes using hybrid modern authentication, you can submit false positives (good email that was blocked or sent to junk folder) and false negatives (unwanted email or phish that was delivered to the inbox) to Exchange Online Protection (EOP).

What do you need to know before you begin?

Watch this short video to learn how you can use Microsoft Defender for Office 365 to easily investigate user submissions to determine the contents of a message, and respond to the submission by applying the appropriate remediation action.

Important

To view messages reported to Microsoft on the User reported messages tab at https://security.microsoft.com/reportsubmission, don't turn off the built-in reporting experience.

Use the Report Message feature

Report junk and phishing messages

For messages in the Inbox or any other email folder except Junk Email, use the following method to report spam and phishing messages:

  1. Select the More actions ellipses on the top-right corner of the selected message, select Report message from the dropdown menu, and then select Junk or Phishing.

    The More actions icon

    The Junk and Phishing option in the Report Message pane

  2. The selected messages will be sent to Microsoft for analysis and:

    • Moved to the Junk Email folder if they were reported as spam.
    • Deleted if they were reported as phishing.

Report messages that are not junk

  1. Select the More actions ellipses on the top-right corner of the selected message, select Report message from the dropdown menu, and then select Not Junk.

    The icon that provides more actions

    The Not Junk option under the Report Message pane

  2. The selected message will be sent to Microsoft for analysis and moved to Inbox or any other specified folder.

View and review reported messages

To review messages that users report to Microsoft, you have these options: