Our report phishing button integration for Microsoft works by simply forwarding our simulation email to CybSafe to be included in your reporting stats.

The generic inbound email address is [email protected]. The local-part of the email address is customisable to your organisation, it does not have to be called "report".

CybSafe recommends a simple email forwarding approach:

The first step in this integration is to enable the Report Phishing Add-In for your organisation.

The full Microsoft instructions can be found in the article, Enable the report message or the report phishing add-ins.

For this integration to work successfully CybSafe requires the report phishing add-in for your organisation to be setup.

Once installed and setup you can move onto configuring your report phish button and ensuring the emails are forwarded to the CybSafe report phish mailbox with the instructions below.

There are two sets of configuration that need to be done to your button to report phishing emails to CybSafe.

You can find all the information from Microsoft in the following article, user reported message settings.

This article will help you to configure the button to send reported phishing emails to Microsoft for analysis and/or to an internal mailbox for analysis.

Once setup correctly you will then need to create a mail flow rule to also report the phishing emails to CybSafe.

How you setup the mail flow rule will depend on your settings for the user submissions address as per the instructions above.

You can create the rule to use the Microsoft address or your internal email address as the recipient or both, dependant on your config.

Instructions if a button is configured to report to Microsoft.

When a user clicks on report phish using the native Microsoft button the email is sent to [email protected] if you have configured the button to report emails to Microsoft.

Using mail flow rules, you will essentially setup a forward from the button for any emails sent to the Microsoft email address to be sent to [email protected].

i.e. The Recipient is [email protected]

The following Microsoft article will provide all of the latest advice in setting up a mail flow rule in Exchange Online.
​Use mail flow rules to see what your users are reporting to Microsoft in Exchange Online.

See changes in regards to the Microsoft tracking email change.

Instructions if a button is configured to not report to Microsoft, but rather deliver to an internal mailbox.

When a user clicks on report phish using the native Microsoft button the email is sent to your designated internal email address, if you have configured the button to only report emails internally and not to Microsoft.

Using mail flow rules, you will essentially setup a forward from the button for any emails sent to your designated email address to be sent to [email protected].

i.e. The recipient is your internal email address

The following Microsoft article will provide all of the latest advice in setting up a mail flow rule in Exchange Online.
​Use mail flow rules to see what your users are reporting to Microsoft in Exchange Online.

Use the following information for your SOC team to automate triage of our phishing simulation reports.

In addition to the allow listing signatures, CybSafe emails always contain HTML with this signature format (with an example ID below):

Email triage can be automated with a body search for cs-unique-ref

If you still have any questions, you can contact the team at [email protected] and we will be happy to answer any further concerns.