How to Report a Phishing Email and What the Helpdesk Does Next

Most phishing that gets through is caught by a person, not a filter. The user who pauses and reports a message is your best detection system, and how the helpdesk responds decides whether they do it again.

This post has two halves. The first is short and written for users: how to report. The second is for the helpdesk: what to do with the report, how to find and remove the same message from other mailboxes, and the checklist for a user who clicked.

For users: how to report a suspicious email

Do not reply, do not click any link, do not open any attachment, and do not forward it to colleagues to ask if it is real. In Outlook, select the message and use the Report button on the ribbon (Report > Report phishing) or the Report message add-in. That sends it to IT with the full headers intact and moves it out of your inbox. If you do not see a Report button, use Forward as attachment to the security mailbox your IT team has published, because a plain forward strips the information we need.

If you already clicked a link or typed your password before you realised, say so in the report. Nobody is going to be angry; a fast report is the thing that keeps it from becoming a bigger problem.

What the helpdesk does first

Reports from the Report button land in the Defender portal under Actions & submissions > Submissions > User reported, and, if configured, in your security mailbox. Open the message headers and look at the Authentication-Results line: SPF, DKIM and DMARC results and the compauth verdict. A message that claims to be from the CEO and fails all three is an easy call. Then look at the link targets and the attachment types.

Confirm it is phishing: headers, sender domain, link destinations, urgency in the text.
In Defender go to Email & collaboration > Explorer and search by subject, sender or the URL to find every mailbox that received it.
Select those messages and take action: Soft delete or Move to junk removes them from every inbox at once. Record the count in the ticket.
Submit the message to Microsoft from the Submissions page so the filter learns it.
Block the sender or domain in the Tenant Allow/Block List if it is a clear campaign, and block the URL if users are likely to see it again.
Reply to the reporter. Thank them, tell them what it was, and confirm it has been removed.

If the user clicked or entered a password

Treat this as a possible account compromise until proven otherwise, and move quickly. The attacker's usual first moves after a successful phish are to add an inbox rule that hides their activity, set up forwarding, register their own MFA method, and consent to an OAuth app that keeps access after the password changes. Your checklist has to cover every one of those.

Reset the password and revoke all sessions from the user's page in the Entra admin center.
Check Authentication methods for any newly added phone or Authenticator and remove what the user does not recognise.
List inbox rules and forwarding with the command below and delete anything the user did not create. Look for rules that delete or move mail to RSS Feeds or Archive.
Check Entra ID > Enterprise applications > Consent and permissions for new user consents, and revoke them.
Read the sign-in log for the account: unfamiliar countries, new devices, or sign-ins right after the click time.
Search the Sent Items and the message trace for mail the account sent since the click; the attacker often phishes the user's contacts next.
Tell the user what you did and ask them to watch for unexpected MFA prompts.

Get-InboxRule -Mailbox jsmith@contoso.com | Format-List Name, Enabled, ForwardTo, RedirectTo, DeleteMessage, MoveToFolder
Get-Mailbox jsmith@contoso.com | Format-List ForwardingAddress, ForwardingSmtpAddress, DeliverToMailboxAndForward

Set up the report button and where reports go

The Report button only helps if it is on and points somewhere. In the Defender portal go to Settings > Email & collaboration > User reported settings. Turn on the Microsoft Outlook Report Message button, choose whether reports go to Microsoft, to a mailbox of yours, or both, and set the mailbox. Sending to both is the usual choice: Microsoft improves the filter and you get to see what your users are seeing.

Publish one sentence for staff: use the Report button, and if you clicked, tell us. Put it in the onboarding pack and repeat it after any real incident. Users who see a thank-you and a quick outcome from their last report are the ones who report the next one.

Close the loop and learn from it

Every report should end with a note in the ticket: what the message was, how many mailboxes got it, what was removed, and whether anyone interacted. Over a few months that record shows you which themes get through, which teams are targeted, and whether your filtering rules need adjusting. If the same lure keeps landing, that is a training topic and a filter rule, not another round of removals. If your team does not have time to work every report properly, RackLedge runs this process for clients as part of managed IT.

Frequently asked questions

Is it safe for helpdesk staff to open the reported email?

Open it in the Defender portal or in a sandboxed viewer rather than in your own Outlook, and never open attachments on a production machine. Use Explorer's preview and the URL detonation results instead.

How fast do we need to act if someone entered their password?

As soon as you know. Attackers automate the first steps after a successful phish, so reset the password and revoke sessions first, then work the rest of the checklist.

Takeaway

Make reporting a one-click action, thank every reporter, and work the report the same way each time: confirm, find every copy, remove, submit, block. When a user has clicked, run the compromise checklist without delay, because inbox rules, forwarding and rogue MFA methods are how a phish turns into a breach.