Microsoft 365 (Defender for Office 365)
Purpose
This guide shows Microsoft 365 admins how to configure the built-in Microsoft Defender “Report Phish” button so that reported emails are securely forwarded to CyberHoot at:
Messages are delivered as .eml attachments, allowing CyberHoot to:
- Credit users for reporting simulated phishing
- Update AttackPhish campaign results
- Award HootScore points
Architecture Overview (Important)
Microsoft 365 uses two control layers:
- Microsoft Defender (Outbound spam policy)
Controls whether external automatic forwarding is allowed at all - Exchange Mail Flow Rules (Transport rules)
Control where forwarded mail is allowed to go
Defender alone cannot restrict forwarding to a single address. Transport rules are required for tight control.
Prerequisites
- Microsoft Defender for Office 365
- Global Admin or Security Admin role
- Exchange Admin access
- No transport rules that strip attachments (.eml)
PART 1 — Configure Microsoft Defender “Report Phish” Button
Step 1: Sign in to Microsoft 365 Defender
Step 2: Open User Reported Settings
- Navigate to:
Email & collaboration → User reported settings
Step 3: Enable Reporting
Configure the following:
- Monitor reported messages in Outlook:
Enabled - Send reported messages to:
My reporting mailboxORMicrosoft and my reporting mailbox
- Reporting mailbox address:
[email protected]
Save settings.
Result:
When users click Report Phish in Outlook, the original message is forwarded as an .eml attachment to CyberHoot.
PART 2 — Allow External Forwarding (Restricted Scope)
Microsoft blocks external forwarding by default. You must allow it only for this purpose.
Step 4: Create a Custom Outbound Spam Policy
- In Microsoft 365 Defender
- Go to:
Email & collaboration → Policies & rules → Threat policies → Anti-spam - Open Outbound spam policies
- Click Create policy
Policy Settings
- Name:
Allow Report Phish Forwarding - Automatic forwarding: On
- Scope:
- Apply only to:
- Users who will report phishing
OR - A specific security group (recommended)
- Users who will report phishing
- Apply only to:
Set policy priority higher than Default.
Save.
This allows forwarding — but does not yet restrict the destination.
The post HowTo: Configure CyberHoot’s Report Phish Integration appeared first on CyberHoot.