Report phishing from Outlook

Part ofTake part as a member of staff

Report a suspicious email to your security team with one button in Outlook. This page explains how an admin makes the button available, how you connect it to your security team with a personal token from Counsel, and what happens when you report a message.

Who does what

Who	What they do
Admin	Downloads the add-in file from Counsel and deploys it to the organisation in the Microsoft 365 admin center. Done once.
Everyone	Creates a personal reporting token in Counsel, pastes it into Outlook once per device, and reports suspicious messages.

Before you begin

The Report phishing add-in works in Outlook on the web, the new Outlook for Windows and Outlook for Mac.

Outlook on phones and tablets is not supported.

Your admin must have deployed the add-in. If you don't see Report phishing in Outlook, ask your IT team.

Note

The classic Outlook for Windows is not supported.

Deploy the add-in for your organisation

An admin does this once.

In Counsel, open the profile menu at the top right and select Manage profile.

Scroll down to the Report phishing from Outlook card.

Select Download Outlook manifest. Counsel downloads a file named soveryne-report-phishing.xml. It is prepared for your organisation's Counsel.

In the Microsoft 365 admin center, open Integrated apps and deploy the downloaded file as a custom add-in for the people who should have the button.

The card reminds you: "Admins: download the manifest and deploy it in the Microsoft 365 admin center → Integrated apps." Every user sees the download button, but only a Microsoft 365 administrator can deploy the add-in.

Create your reporting token

Each person creates their own token in Counsel. Create one token for each device you use Outlook on, so you can switch off one device without affecting the others.

Open the profile menu at the top right and select Manage profile. The Your profile window opens.

Scroll down to the Report phishing from Outlook card.

In Token name, type a name that tells you where you will use it, for example "Work laptop" (up to 80 characters).

In Expires after (days), keep 90 or choose a number from 1 to 180.

Select Create token.

Counsel shows the token once, with the warning "Copy this token now — it will not be shown again." Select Copy.

Paste the token into Outlook straight away (see the next section), then select Done.

The Report phishing from Outlook card in Your profile, with the Create token form

Your tokens are listed in the card with their name, the start of the token, when they expire and when they were last used ("Never" if not yet). An expired token is marked "Expired".

You can have at most ten active tokens at a time.

Connect Outlook to your security team

Do this once on each device, with the token you created for it.

In Outlook, open any message.

In the message ribbon, select Report settings (in the Report phishing group). The Report settings pane opens. It reminds you where to create a token: your profile menu › Manage profile › Report phishing from Outlook.

Paste your token into Reporting token.

Optionally, select Check token. Outlook shows "The server accepted this token." if it works.

Select Save. Outlook shows "Saved. You can now report messages with the Report phishing button."

Outlook keeps the token in your mailbox settings. To disconnect, open Report settings and select Remove token.

Report a suspicious message

Open the suspicious message in Outlook.

Select Report phishing.

Outlook explains: "A copy of this message will be sent to your security team for review, and the message will be moved to your Junk Email folder."

Under What made this message look suspicious?, choose a reason: Suspicious link, Asks for my password or payment, Unexpected attachment, Impersonates someone I know or Other.

Optionally, add a note in Anything else your security team should know? (optional).

Confirm the report.

Outlook shows "Thanks for reporting" and "Your security team will review this message." The message is moved to your Junk Email folder.

Reporting the same message twice is harmless: your security team receives it once.

You don't get further updates about a report in Outlook or Counsel.

Revoke a token

Revoke a token when you lose a device, stop using it, or think someone else has the token.

Open the profile menu and select Manage profile.

In the Report phishing from Outlook card, select Revoke on the token's row.

Confirm: "Revoke this token? The add-in that uses it stops working."

The token disappears from the list. Reporting from the device that used it stops until you paste a new token there.

How reporting protects you

A reporting token can only send phishing reports. It cannot open Counsel or read anything.

Counsel shows each token only once, when you create it.

Every token expires after the number of days you chose, from 1 to 180.

A reported message is moved to Junk Email, never deleted. If the report fails, the message is still moved to Junk Email.

Troubleshooting

Message	What it means	What to do
"Set up phishing reporting"	No token is saved on this device. The message was not moved.	Open Report settings, paste your token, select Save, and report the message again.
"Reporting token expired"	Your token expired or was revoked. The message was not moved.	Create a new token in Counsel, paste it in Report settings, and report the message again.
"Report not sent"	The message was moved to Junk Email, but the report did not reach your security team.	Report it again later, or contact your security team.
"That doesn't look like a reporting token. It starts with tok_ — copy it again from Counsel (profile menu → Manage profile)."	What you pasted is not a complete token.	Create a new token in Counsel (profile menu › Manage profile) and copy it with Copy.
"The server rejected this token. It may have expired or been revoked — create a new one in Counsel."	The token is no longer valid.	Create a new token and paste it.
"Couldn't reach the server. Check your connection and try again."	Outlook could not contact Counsel.	Check your internet connection and try again.
"Choose between 1 and 180 days."	The expiry is outside the allowed range.	Enter a number from 1 to 180.
"Give the token a name (up to 80 characters)."	The token name is empty or too long.	Enter a shorter name.
"Could not create the token: …"	Counsel refused the token. You may already have ten active tokens, or have created many tokens in the last hour.	Revoke a token you no longer use, or wait an hour and try again.
"Could not download the manifest: …"	The add-in file is not available for your Counsel.	Contact your Soveryne partner or Soveryne.

← PreviousYour uploads Next →ATLAS