Forum Discussion
Solved
Microsoft Defender 365 Admin Center: User vs Admin Submissions
We use the Report Message add-in (https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure?view=o365-worldwide) to allow users to report emails.
These emails are then shown as "User reported" under "Actions & Submissions, Submissions" in the Microsoft 365 Defender Admin Center.
I couldn't find information if Microsoft is reviewing this emails automatically (and improving the filters if necessary) or if nothing happens until an admin submits these emails to Microsoft for analysis?
Assuming this is not auto-submitted, can this be enabled?
- "reporting" a message from the add-in is different from the "submissions" feature, though they do have some similarities. The action taken via the add-in by default reports the message to Microsoft, and they in turn use this as "signal" to adjust the filtering model. Such messages are also listed under the User reported section, so you as the admin can keep an eye on them, and if needed, decide to take additional actions. You can however disable this "send to Microsoft" action, for example if you need to address some privacy requirements, etc. The configuration is done via: https://security.microsoft.com/securitysettings/userSubmission
2 Replies
- "reporting" a message from the add-in is different from the "submissions" feature, though they do have some similarities. The action taken via the add-in by default reports the message to Microsoft, and they in turn use this as "signal" to adjust the filtering model. Such messages are also listed under the User reported section, so you as the admin can keep an eye on them, and if needed, decide to take additional actions. You can however disable this "send to Microsoft" action, for example if you need to address some privacy requirements, etc. The configuration is done via: https://security.microsoft.com/securitysettings/userSubmission
- Thank you very much for clarifying this!
