NINJIO ALERT: Setup Native Outlook Button (for IT Pros)

This article covers how to configure Microsoft's native Outlook "Report" button to work with NINJIO's simulated phishing reporting platform.

Prerequisite notes on Microsoft behavior:
Microsoft Exchange Online mail flow rule changes are not always immediate. Microsoft advises that new or updated mail flow rules can take up to 30 minutes to apply,
 

Part A - Setup shared mailbox
Microsoft requires an internal mailbox as the destination for reported emails. A shared mailbox is recommended for this purpose, as it does not require a license.

1. Go to Exchange Admin Center, under “Recipients”, select “Mailboxes”
2. Click “Add a shared mailbox”
3. For “Display name”: We recommend “Reported Phish”
4. For “Email address”: We recommend “reported-phish”. Select your preferred domain.

Part B - Configure mail routing
A mail flow rule will be created to automatically route simulated phishing emails to the NINJIO reporting platform.

1. Within Exchange Admin Center, under “Mail flow”, select “Rules”
2. Click “Add a rule”, then “Create a new rule”
3. For “Name”: We recommend “NINJIO Simulated Phish Redirector”
4. For “Apply this rule if”: Select “The recipient” and “is this person”
   1. Select the mailbox we created (e.g. “Reported Phish”), then “Save”
   2. Then next to the same “Apply this rule if”: Click “+”

5. Under “And” area: Select “The subject or body” and “subject or body includes any of these words”

   1. Enter each of the following, clicking “Add” after each:

   [168.245.68.235]
   [69.72.33.74]
   [198.244.55.48]
   client-ip=168.245.68.235
   client-ip=69.72.33.74
   client-ip=198.244.55.48

6. Then click “Save”
7. For “Do the following”: Select “Redirect the message to” and “these recipients”
8. Enter ”reported-messages@ninjio.com”, select it within the Suggested results, click “Save”, then “Next”
9. For “Severity”: Select “Low”
10. For “Comments”: We recommend “This is a rule to redirect simulated phish to NINJIO when users click the Native Outlook Report Phish button”
11. Click “Next”, then “Finish”, then “Done”
12. Still on the Mail flow->Rules page, click into the rule we created (e.g. “NINJIO Simulated Phish Redirector”)
    1. For “Enable or disable rule”: Toggle it to “Enabled”
    2. Click "Edit rule settings"
    3. For "Priority": Set it to "0", then click "Save", then "Done"

Part C - Configure Outlook button
The native Outlook Report button will be enabled and deployed to all users.

1. Go to Microsoft Defender - User reported settings
   1. Under “Outlook”:
      1. Ensure “Monitor reported messages in Outlook” is checked
      2. Ensure “Use the built-in Report button in Outlook” is checked
   2. Under “Reported message destinations”:
      1. Select “Microsoft and my reporting mailbox”
      2. Add the shared mailbox we created (e.g. “Reported Phish”)
2. Click “Save”, it may take several hours from this point to propagate to users.