Outlook Report button missing? How to fix it

A staff member gets an email that looks wrong and wants to flag it, but there is no Report button in Outlook. Or the old Report Message or Report Phishing add-in is there, but not the newer built-in button. This is common in Microsoft 365 businesses that set up email a few years ago. An admin can usually fix it in about 15 minutes, and staff then have a one-click way to report phishing (fake emails that try to steal passwords or money).

This guide covers Microsoft 365 organisations with mailboxes in Exchange Online. It is based on Microsoft’s current documentation for the built-in Report button in Outlook, last updated on 3 July 2026.

Before you start

An admin account. To change the reporting settings you need the Security Administrator role (or the Security Administrator or Hygiene Management role group in Exchange Online). Removing old add-ins needs the Organization Management role group or Global Administrator. If you don’t have these, ask whoever manages your Microsoft 365.
A supported version of Outlook. The built-in button works in Outlook on the web, the new Outlook for Windows, Outlook for Mac 16.89 or later, Outlook for iOS 4.2511 or later and Outlook for Android 4.2446 or later. In classic Outlook for Microsoft 365, Current Channel needs version 16.0.17827.15010 or later, Monthly Enterprise Channel needs 16.0.18025.20000 or later, and Semi-Annual Channel needs release 2502 (build 16.0.18526.20024) or later.
About 15 minutes, plus up to 24 hours if you remove an old add-in.

Warning: these steps change a security setting for your whole organisation. Before you change anything, take a screenshot of the current User reported settings page so you can put it back. In particular, note which mailbox currently receives reported emails, because someone may already be checking it.

Fix 1: Update Outlook

If the button is missing for only one or two people, their Outlook is often too old.

Check which Outlook the person uses and its version number.
Compare it with the supported versions listed in Before you start.
If it is older, update Outlook. Microsoft recommends updating clients through the Microsoft 365 admin center, or asking users to update their own Outlook.
Restart Outlook and look for the Report button. If it is still missing, move to Fix 2.

Fix 2: Turn on the built-in Report button

If nobody in the business sees the button, the setting is usually off, or Outlook is set to use a different reporting add-in. Microsoft explains that the button only appears when user reporting is turned on and the built-in button is chosen in the user reported settings.

Sign in to the Microsoft Defender portal at security.microsoft.com with your admin account.
Go to Settings > Email & collaboration > User reported settings.
In the Outlook section, tick Monitor reported messages in Outlook.
Under Select an Outlook report button configuration, choose Use the built-in Report button in Outlook.
Under Send reported items to, choose where reports go. Microsoft and my reporting mailbox is the default and suits most businesses: Microsoft analyses the email and a copy goes to a mailbox you can check.
In Add an Exchange Online mailbox to Send reported items to, pick the mailbox that should receive reports. If you leave it blank, reports go to the global admin’s mailbox. Distribution groups and outside mailboxes are not allowed.
Select Save.
Open Outlook on the web and select an email. You should now see a Report button.

Fix 3: Remove the old Report Message or Report Phishing add-in

Microsoft has put the older Report Message and Report Phishing add-ins into maintenance mode and says they will be retired, partly because of security issues with them. Its transition guide recommends moving everyone to the built-in button. Do Fix 2 first so staff are never left without a way to report.

Sign in to the Microsoft 365 admin center at admin.microsoft.com.
Select Show all if needed, then go to Settings > Integrated apps.
On the Deployed apps tab, select the Report Message or Report Phishing add-in.
On the Overview tab, select Remove app.
Confirm the removal and select Remove. You should see Successfully removed.
Allow up to 24 hours for the add-in to disappear from everyone’s Outlook.

If a large team needs time to move across, Microsoft lets you limit the old add-in to specific users or groups from the add-in’s Users tab instead of removing it straight away. The built-in button itself can’t be limited to some users; it is on for everyone by design.

How staff use the Report button

Once the button is on, show your team these steps. They work the same way in most versions of Outlook.

Select the suspicious email (or several emails).
Select Report. Selecting the button itself reports the email as phishing.
To choose a different option, open the arrow next to Report and pick Report phishing or Report junk.
If a genuine email has landed in Junk Email, select it there, then Report > Not junk to move it back to the Inbox.

Staff should know what happens next. An email reported as phishing is deleted from their mailbox. An email reported as junk moves to Junk Email and the sender is blocked. That is expected, so they should report rather than forward the email to a colleague or IT, which spreads it further.

Reporting is one part of email protection. Our cyber security services cover the rest, including sign-in and device security.

Small, medium and large businesses

Small businesses

Most small businesses only need Fix 2. Choose a reporting mailbox that someone actually reads, such as the owner’s or office manager’s, and check it each week. Tell staff the button is there and what it does.

Medium businesses

Check Outlook versions across the team before you start, because older classic Outlook is the usual reason the button is missing for some people. Use a dedicated shared mailbox for reports. Admins can also review every report on the User reported tab of the Submissions page in the Defender portal.

Large businesses

Plan the move from the old add-ins through change control. Turn on the built-in button, limit the old add-in to a pilot group, then remove it once everyone has a supported Outlook version. If you use a separate phishing-training tool with its own report button, set Use a non-Microsoft add-in button in the user reported settings instead, so reports still reach Microsoft and your reporting mailbox.

When to call Tech Arena

Stop and get help if:

someone has already clicked a link, opened an attachment or typed a password into a suspicious email, as this may be a security incident
the button is still missing after Fixes 1 and 2, or is missing on many computers
you don’t have the admin access these steps need
you are not sure who currently receives reported emails, or whether a third-party reporting tool is in use

Our Microsoft 365 support can set up reporting and update Outlook across your team, and our IT support and helpdesk can help with day-to-day email problems. To talk it through, or to book a free IT health check with no obligation, contact us.