Report false positives and false negatives in Outlook

Important

The improved Microsoft 365 security center is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. Learn what's new.

Applies to

Note

If you're an admin in a Microsoft 365 organization with Exchange Online mailboxes, we recommend that you use the Submissions portal in the Security & Compliance Center. For more information, see Use Admin Submission to submit suspected spam, phish, URLs, and files to Microsoft.

In Microsoft 365 organizations with mailboxes in Exchange Online or on-premises mailboxes using hybrid modern authentication, you can submit false positives (good email that was blocked or sent to junk folder) and false negatives (unwanted email or phish that was delivered to the inbox) to Exchange Online Protection (EOP).

What do you need to know before you begin?

Use the Report Message feature

Report junk and phishing messages

For messages in the Inbox or any other email folder except Junk Email, use the following method to report spam and phishing messages:

  1. Select the More actions ellipses on the top-right corner of the selected message, select Report message from the dropdown menu, and then select Junk or Phishing.

    Report Message - More actions

    Report Message - Junk and Phishing

  2. The selected messages will be sent to Microsoft for analysis and:

    • Moved to the Junk Email folder if they were reported as spam.
    • Deleted if they were reported as phishing.

Report messages that are not junk

  1. Select the More actions ellipses on the top-right corner of the selected message, select Report message from the dropdown menu, and then select Not Junk.

    Report Message - More actions

    Report Message - Not junk

  2. The selected message will be sent to Microsoft for analysis and moved to Inbox or any other specified folder.

View and review reported messages

To review messages that users report to Microsoft, you have these options: