Submit PHISHING & SPAM samples to Microsoft

[Ketzpatel]

We receive several phish and spam messages everyday and we used to submit to Microsoft using the submission portal. we recently developed an automated process where when user reports this messages as an attachment to us in a shared mailbox, we extract that attachment using power automate and send to another mailbox and from there we use forwarding to send to Email address removed. So far we have submitted almost 29000 messages in 9 months and I am wondering if Microsoft analyze these messages and take actions on their ML or AI logic or algorithm for phishing and spam messages.

[#2]

Yes, they are being checked. Compared to other reports for the same senders and recipients and the filters and AI are updated accordingly, if MS determines it is a valid threat.
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/report-junk-email-messag...
Data from submissions to Microsoft resides in the Office 365 compliance boundary in North American data centers. The data is reviewed by analysts on the engineering team to help improve the effectiveness of the filters. The submission is considered feedback to help improve the filters and is kept for a period of 30 days. After which, it is deleted.

[#3]

Look at the confidence of the sightings being sent to you. Are the senders sure the mails are spams or phish, or are they asking you for an opinion?

If they are asking for an opinion then yes, you have to process the sighting and respond or react.

If they are confident the mail is unwanted, they should be saving you the time by reporting the sighting themselves. For Exchange Online you want to deploy the Report Message add-in (and there is talk that it is about to be folded into the main Outlook program). For on-premises Exchange, I believe they have to send direct but there are still established ways to ensure your SecOps team get a copy of whatever is being reported.

[#4]

Thanks for the help ExMSW4319.
Our InfoSec team does not allow Outlook add-in so we use 3rd party add-in and when user submit the message using 3rd party, the messages delivered to a shared mailbox as an attachment. We have designed a automated process using mail rule and Power automate that extract the spam or phish emails as an attachment sent by user to shared mailbox and delivered to another mailbox which is managed by messaging. from the another shared mailbox, we send the email as an attachment to MS at Email address removed and MS confirmed that this is valid process and they accept the messages and those emails should appear in user reported email view in submission portal but as of now we are unable to see any messages.

[#5]

Hi, would it be possible to create a power automate flow to check the submissions list and as MS has added a verdict to a submission trigger a e-mail thanking the user who submitted the phish? Anyone who has created such flow and could share learnings?