Report Message and Report Phishing Deemed Unsafe by Microsoft

Message center notification MC1030003 (12 March 2025) brings news that the built-in Report button (Figure 1) is available for all Outlook clients (from these versions on). The older Report Message and Report Phishing add-ins are now in maintenance mode. Although they continue to work, Microsoft recommends that the add-ins should be removed before the time comes when Microsoft retires and finally removes the now-obsolete add-ins.

Microsoft cites many benefits for the new Report button, including support for reporting email delivered to shared mailboxes, better localization, and the ability to report messages from different places, like the preview window. My favorite is that users can’t report their own messages as junk because Outlook disables the Report button for messages sent by the mailbox owner. For now, this feature only seems to work in OWA and the new Outlook and sometimes it doesn’t work, but it’s certainly a good thing.

If users don’t see the Report button, it could be that the user reported settings in the Microsoft Defender portal need to be adjusted. These settings control whether users can submit messages suspected to be junk email or phishing attempts to Microsoft for analysis.

Some organizations don’t permit people to report email because they don’t want Microsoft personnel to be able to read the reported messages. That’s certainly a valid perspective, but phishing techniques evolve on an ongoing basis and a reported message could disclose a new technique that allows Exchange Online Protection to detect and block dangerous content. Overall, I think it’s best to allow users to report bad email.

Unsafe Add-ins

Rather alarmingly, the FAQ for the built-in Report button says that “there are security issues with the add-in which makes them unsafe for the organization” without saying or even hinting what those issues might be. The FAQ also says that the add-ins “can’t architecturally support functionality that customers keep asking for.” Again, no further information is given to back up the claim. It’s more likely that the problem is that these add-ins are COM-based. Microsoft is dumping this technology as it moves forward with the new Outlook for Windows.

Checking the Report Add-ins

Unless good reason exists not to use built-in client functionality, it’s best to use it rather than add-ins. Given the profusion of integrated apps that could appear in tenants due to Copilot agents, administrators are likely to be busy managing those apps. Getting rid of a few obsolete add-ins won’t ease the agent burden, but it’s step in the right direction.

Taking my own advice to heart, I checked in the Integrated apps section of the Microsoft 365 admin center to see if the Report Message and Report Phishing add-ins were still in use. As you can see from Figure 2, just one active user was detected.

The download option creates a CSV file that gives some details about the app and when it was used, but it doesn’t point to who is using the app. The app properties might be configured to allow access to the add-in to specific users or groups, and that could give a clue to who might be using it. But you’re out of luck if the app is configured for tenant-wide access.

Removing an Add-in

It’s always best to let users know that a change in coming. Microsoft says that people prefer the single Report button. In any case, changing from the add-in to the built-in report button shouldn’t prove too difficult for anyone, so I went ahead and removed the add-in from the set of Integrated apps (Figure 3).

It takes some time for a change like this to make its way to clients. Microsoft documentation says that it can take up to 24 hours before a newly deployed app appears in a client. The same applies to app deletions. My experience is that it can take longer before all clients receive updates. However, removed add-ins should disappear in a couple of days.

I’m glad to report that the removal of the old Report Phishing add-in from my tenant went according to plan. No squawking from annoyed users has happened so far. Maybe they haven’t noticed the change yet.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.