Forum Discussion

GalgoArmy's avatar
GalgoArmy
Copper Contributor
Jun 25, 2026

Microsoft Defender (GCC) - User Submitted "Mark and Notify" for Third Party Phishing Simulations

Our Microsoft 365 tenant is in the GCC environment, and we use a third party phishing simulation platform along with the built in Outlook Report Message button (not a third party reporting add in).

 

When a user correctly reports one of our simulated phishing emails, the message appears in Microsoft Defender > User Submitted as expected.

 

The problem is what happens next.

 

When we select Mark and notify, the only available options are:

 

Phishing

Spam

No threat found

 

There is no option to notify the user that the email was actually part of a phishing simulation.

 

This creates a difficult situation:

 

If we choose No threat found, Defender tells the user the message was safe, making it appear they incorrectly reported the email even though they did exactly what we trained them to do.

If we choose Phishing, the user receives the correct feedback, but the message is counted as a real phishing event, affecting our Defender metrics and potentially generating false incidents and reporting.

 

It feels like we're stuck in a design loop where neither option provides the desired outcome.

 

My questions are:

 

Is there a supported way in Microsoft Defender (particularly GCC) to notify users that a reported message was a simulated phishing email when using the native Outlook Report Message button?

Is this capability available in Commercial tenants but not GCC, or is it unavailable across all environments?

If this functionality does not exist, what is the recommended process for submitting a feature request specifically for the GCC version of Microsoft Defender? This seems like a valuable enhancement for organizations that use third party phishing simulation platforms while relying on Microsoft's native reporting experience.

 

Has anyone else found a good workflow for this scenario?

No RepliesBe the first to reply