Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Submissions User Reported Messages Custom Mailbox

1 October 2026Doc update+9 / −21 lines

In brief

The article’s metadata links and update date changed. Teams-specific explanatory text and several Teams-related parameters were removed from the reported-message policy examples.

What Defender admins need to know

Administrators using this article to configure report submission policies should refer to the revised PowerShell examples.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Tip

If Monitor reported items in Microsoft Teams is selected in the Microsoft Teams section when Use a non-Microsoft add-in button is also selected, the settings in the Email notifications sections are available. But, these settings apply only to user-reported Teams messages. For more information, see User reported message settings in Microsoft Teams.

In attack simulation training in Defender for Office 365 Plan 2, simulation messages reported by non-Microsoft tools aren't captured in attack simulation reports.

Message submission format for non-Microsoft reporting tools

In this example, the email address of the reporting mailbox is userreportedmessages@fabrikam.com in Exchange Online (you can't specify an external email address).

Tip

The value -ReportChatMessageEnabled $false is required to achieve Send reported items to > My reporting mailbox only. Even when the ReportChatMessageEnabled property value is $false in PowerShell, the Monitor reported message in Microsoft Teams settings on the User reported settings page is selected. Selecting or unselecting Monitor reported message in Microsoft Teams on the User reported settings page doesn't change the value of the ReportChatMessageEnabled property in PowerShell.

$usersub = "userreportedmessages@fabrikam.com"

New-ReportSubmissionPolicy -EnableReportToMicrosoft $false -EnableUserEmailNotification $true -ReportJunkAddresses $usersub -ReportNotJunkAddresses $usersub -ReportPhishAddresses $usersub -PreSubmitMessageEnabled $false -PostSubmitMessageEnabled $false -ReportChatMessageEnabled $false

New-ReportSubmissionRule -Name DefaultReportSubmissionRule -ReportSubmissionPolicy DefaultReportSubmissionPolicy -SentTo $usersub

The remaining settings are the default values in "Other settings" as described in the Use PowerShell to configure reporting in Outlook with report messages to Microsoft and the reporting mailbox section.

Tip

The value -ReportChatMessageEnabled $false is required to achieve Send reported items to > Microsoft only. Even when the ReportChatMessageEnabled property value is $false in PowerShell, the Monitor reported message in Microsoft Teams setting on the User reported settings page is selected. Selecting or unselecting Monitor reported message in Microsoft Teams on the User reported settings page doesn't change the value of the ReportChatMessageEnabled property in PowerShell.

The values -EnableUserEmailNotification $true and -ReportChatMessageToCustomizedAddressEnabled $false are required to achieve Send reported items to > Microsoft only.

New-ReportSubmissionPolicy -ReportJunkToCustomizedAddress $false -ReportNotJunkToCustomizedAddress $false -ReportPhishToCustomizedAddress $false -PreSubmitMessageEnabled $false -PostSubmitMessageEnabled $false -EnableUserEmailNotification $true -ReportChatMessageToCustomizedAddressEnabled $false -ReportChatMessageEnabled $false

Because a reporting mailbox isn't used, the report submission rule isn't needed or created. ```powershell $usersub = "reportedmessages@contoso.com"

Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -EnableReportToMicrosoft $true -EnableThirdPartyAddress $false -ThirdPartyReportAddresses $null -ReportJunkToCustomizedAddress $true -ReportJunkAddresses $usersub -ReportNotJunkToCustomizedAddress $true -ReportNotJunkAddresses $usersub -ReportPhishToCustomizedAddress $true -ReportPhishAddresses $usersub -PreSubmitMessageEnabled $false -PostSubmitMessageEnabled $false
-ReportChatMessageEnabled $true
```

And then run one of the following commands, depending on the existing configuration:
```powershell
$usersub = "userreportedmessages@fabrikam.com"

Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -EnableReportToMicrosoft $false -EnableThirdPartyAddress $false -ThirdPartyReportAddresses $null -ReportJunkToCustomizedAddress $true -ReportJunkAddresses $usersub -ReportNotJunkToCustomizedAddress $true -ReportNotJunkAddresses $usersub -ReportPhishToCustomizedAddress $true -ReportPhishAddresses $usersub -PreSubmitMessageEnabled $false -PostSubmitMessageEnabled $false -ReportChatMessageEnabled $false
```

And then run one of the following commands, depending on the existing configuration:

  • Turn on reporting in Outlook if necessary, select Use the built-in Report button in Outlook, and change Send reported items to to Microsoft only. This command clears any previously configured reporting mailbox addresses and sends user reported messages directly to Microsoft for analysis:

    Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -EnableReportToMicrosoft $true -EnableThirdPartyAddress $false -ThirdPartyReportAddresses $null -ReportJunkToCustomizedAddress $false -ReportJunkAddresses $null -ReportNotJunkToCustomizedAddress $false -ReportNotJunkAddresses $null -ReportPhishToCustomizedAddress $false -ReportPhishAddresses $null -PreSubmitMessageEnabled $false -PostSubmitMessageEnabled $false -EnableUserEmailNotification $true
-ReportChatMessageToCustomizedAddressEnabled $false -ReportChatMessageEnabled $false

    The following command is required only if the report submission rule already exists:

    $usersub = "thirdpartyreporting@wingtiptoys.com"

Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -EnableReportToMicrosoft $false -EnableThirdPartyAddress $true -ThirdPartyReportAddresses $usersub -ReportJunkToCustomizedAddress $true -ReportJunkAddresses $usersub -ReportNotJunkToCustomizedAddress $true -ReportNotJunkAddresses $usersub -ReportPhishToCustomizedAddress $true -ReportPhishAddresses $usersub -PreSubmitMessageEnabled $false -PostSubmitMessageEnabled $false
-ReportChatMessageEnabled $true

    And then run one of the following commands, depending on the existing configuration: