Integrating Microsoft Phishing Reporting Button with Keepnet
Last updated
Was this helpful?
Last updated
Was this helpful?
This integration allows your employees to continue using Microsoft’s Phishing Reporting button to report suspicious emails to your SOC team or Microsoft Defender. Along with that, this integration adds new benefits by forwarding reported emails to Keepnet’s Incident Responder. This ensures deeper analysis and tracking capabilities while maintaining your existing reporting process.
Key Benefits:
Dual Reporting: Emails reported via the Microsoft Phishing Reporting Button are sent to both Microsoft Defender and Keepnet's Incident Responder product for advanced analysis.
Simulation Tracking: During phishing simulation campaigns, Keepnet tracks employees who report simulated phishing emails, helping administrators measure awareness and provide training.
If you don’t already have a shared inbox for phishing reports:
Log into the .
Navigate to Recipients > Mailboxes > Add a Shared Mailbox.
Enter a Display Name and Email Address for the shared mailbox.
Click the Create button to create a shared mailbox.
Forward reported phishing emails to Keepnet using a mail flow rule:
Please of Keepnet to get the Keepnet email address for forwarding.
Log into the and open the Exchange Admin Center.
Go to Mail Flow > Rules and click Create New Rule.
Configure the rule:
Name: Enter a name such as "Forward Reported Emails to Keepnet".
Set Apply this rule if: Select the "The recipient" and then select the "is this person" option. Please enter the shared mailbox email address that you created in the previous section.
Do the following: Select the "Add Recipients" and then select the "to the To box" option. Please enter the email address that you got from the Keepnet Support Team.
Leave the "Except if" option as default and then click Next.
Leave the "Set rule settings" page settings as default and then click Next.
Click Finish to create the rule.
Ensure “Monitor reported messages in Outlook” is active.
Choose “Use the built-in Report button in Outlook”.
Set “Reported message destinations” to “Microsoft and my reporting mailbox” or “My reporting mailbox only”.
Add your shared mailbox that you created at the beginning of the document to the "Add an exchange online mailbox to send reported messages to:" field and save.
If not already installed:
Visit Microsoft AppSource and search for “Report Phishing”.
Click Get it now and follow the installation instructions.
Wait up to 12 hours for the add-in to appear in Outlook.
Launch a phishing simulation campaign through Keepnet.
Report a simulation email using the Microsoft Phishing Reporting button. Then, go to your campaign report and click the Reporters menu to verify that you reported the simulation email.
Verify the email is also visible on Keepnet’s Incident Responder page.
Reporting Delays: When Microsoft forwards reported emails to the specified email destination, there may be a delay caused by Microsoft’s internal processing. For example, some emails may appear immediately whilst other emails may take 10 minutes to get reported to Keepnet from Microsoft.
Blocked Emails: Emails flagged as phishing might be quarantined by Microsoft or other security solutions, causing delays in forwarding.
Interference: External security solutions, such as Data Loss Prevention (DLP) systems, may interfere with email forwarding from Microsoft to Keepnet. This can result in delays or prevent emails from being reported altogether.
Email Quarantine: Emails flagged as phishing might be quarantined by Microsoft or other security solutions, causing delays in forwarding.
Policy Conflicts: Custom email policies on the customer’s Microsoft tenant could block or redirect reported emails, affecting Keepnet’s tracking.
Server Downtime: Temporary unavailability of Microsoft or Keepnet’s email servers can result in reporting delays.
Open in your Microsoft 365 portal.