Understanding NINJIO Alert: XML 2.0 Phish Reporting Button – NINJIO Help Center

Executive Summary

The NINJIO XML 2.0 Phish Reporting Button is our next-generation, cloud-native Outlook add-in. Built to integrate seamlessly with modern Microsoft 365 environments, this update transitions the core reporting experience into a native Outlook Sidebar (Taskpane) on desktop and web clients, while introducing advanced data privacy controls and centralized visual customization directly within your administrative portal.

Key Benefits & Capabilities

Streamlined User Experience: Opens as a clean, pinnable Outlook sidebar (Taskpane) on desktop and web clients rather than a disruptive popup dialog.
True Cross-Platform Support: Compatible across modern email ecosystems, including Classic Outlook, New Outlook, Outlook Web App (OWA), and Outlook Mobile (iOS and Android).
Enterprise-Grade Data Privacy: Features an optional Privacy Mode to accommodate highly regulated environments. When activated, no email content ever leaves your local perimeter or reaches NINJIO's cloud infrastructure.
Tailored Security Settings: Administrators can opt to exclude specific message layers—such as strips of text or specific attachments—from automated evaluations to comply with internal privacy standards.
Automated Inbox Remediation: Supports Restore-to-Inbox rules. If a user reports an email that is subsequently verified as safe, the system automatically returns the message to the user’s inbox from their deleted items folder.

⚠️ Important Privacy Note: If your organization requires Privacy Mode to be enabled, all cloud-forwarding pipelines are completely deactivated.

Core Administrative Adjustments: XML 1.0 vs. XML 2.0

For teams upgrading from our legacy framework, please review the operational shifts below:

Functional Area	XML 1.0 Framework	XML 2.0 Framework
Interface Layout	Restricted to popup overlays on desktop clients.	Default Pinnable Taskpane (Sidebar) for desktop/web. Custom choice of popup or sidepane configuration available at download.
Mobile Deployment	Mobile compatibility was unavailable in production.	Fully supported natively inside Outlook for iOS & Android.
Branding Implementation	Base manifests required manual code overrides by support to remove placeholder text and legacy assets.	Generated instantly using branding assets uploaded directly to your portal.
Popup Theming Control	Text configurations and placeholder tools operated with strict technical limits.	Full interface control panel featuring hex color validations, gradient adjustments, and optional logo integration.
Whitelisting Layout	Relied purely on global corporate domain configurations.	Supports granular, per-address whitelisting controls via advanced feature gates.

System Requirements & Limitations

Supported Environments: Classic Outlook, New Outlook, and Outlook Web Access (OWA) across Google Chrome and Microsoft Edge. (Note: In line with industry standards, the plugin cannot run in Incognito or Private browsing sessions).
Mobile Layout Constraint: Because the Microsoft mobile ecosystem does not support third-party application sidebar panels, Outlook Mobile utilizes an optimization fallback that displays an inline popup confirmation window.
Post-Reporting Routing: Post-reporting folder commands are mutually exclusive. The application can automatically move messages to your Deleted Items directory OR route them to a designated Custom Folder, but cannot execute both simultaneously.
Rule Thresholds: Automated platform routing rules can distribute copies of filtered emails to a maximum of three target destination boxes per rule.

Step-by-Step Workflow: Settings Configurations & Active Button Behaviors

Portal Settings Sub-Module / Default Function	Your Administrative Choice / Default State	What the Button Natively Does (End-User Experience)
1. Enable Reporting Button	Master Toggle: ON	Activates the button across your organization. Suspicious emails can now be reported directly from the Outlook ribbon or mobile app. (If turned OFF, the button is completely disabled).
2. Reporting Enablement & Branding	Upload Logo & DisplayName	Automatically skins the add-in. Users will see your company's approved name override (e.g., "Report Spam") and official icon in their Outlook interface.
3. Manifest View Type	Choose "Sidepane" vs. "Popup"	Defines the workspace layout on desktop. Sidepane opens a clean, pinnable sidebar next to the email so users never lose their place. Popup opens a classic confirmation dialog box over the screen. (Note: Mobile apps always use an inline popup due to screen size).
4. Cloud Scan Engine Forwarding	Forward to Cloud: ON (Exclusion Toggles Available)	Sent reports are routed to modern scanning layers to instantly evaluate threats. Admins can use the check boxes to Exclude attachments or Exclude email body text from leaving the local perimeter to meet privacy policies.
5. Privacy Mode Gate	Enable Privacy Mode: ON	Completely strips out the cloud forwarding section. No email content ever leaves your environment or reaches NINJIO's cloud. The system tracks that a user reported a message, but zero data is retained, perfectly matching strict compliance rules.
6. Post-Reporting (Simulation Filtering)	"Do not forward simulation" Checkbox: ON	The Simulation Block Flow: When an employee clicks report, the system instantly scans hidden email attributes (like the unique CRID simulation header). If it matches an internal training drill, the system automatically intercepts it. It logs a "passed test" for the employee, but securely blocks the message from being forwarded to your IT/SOC team—keeping your real security queue completely clean.
7. Post-Reporting (Inbox Clean-Up)	Select Destination folder	Automatically tidies the user's workspace. You can choose to have the reported email instantly vanish into the Deleted Items folder OR shift silently into a custom tracking folder (like "Suspicious Mail"). (These folder actions are safely restricted so only one can be active at a time).
8. Restore Clean Emails	Restore to Inbox Toggle: ON	Safeguards against accidental reports. If an automated evaluation or an administrator clears a reported message as 100% safe, the system automatically pulls it out of the trash and places it right back into the employee's main inbox.
9. User Notifications	Automatic Feedback Rules	Delivers real-time reassurance. The platform automatically fires off tailored emails to the user—sending an instant "Thank You" receipt when they report an email, or alerting them if the file was found to be infected or successfully restored.
10. Default Domain Routing	Natively Handled (Backend Default)	Automatically routes the report to your specific organization's dashboard by tracking the reporting user's exact email domain string.
11. Unified Confirmation Layout	Natively Handled (Backend Default)	Provides a standard, clear confirmation window when a user clicks the button asking: "Would you like to report this email as a phishing attempt?"
12. Multi-Platform Taskpane Pinning	Natively Handled (Backend Default)	Supports workspace efficiency on desktop and web clients by allowing users to "pin" the side pane open so it remains active as they navigate through their inbox.
13. Public Email Support Isolation	Natively Handled (Backend Default)	Natively flags and isolates official security training domains (such as goninjio.com) inside the reporting queue to prevent system alert loops.

Upgrading to XML 2.0?

To successfully deploy our next-generation XML 2.0 Phish Reporting Button and enjoy an updated interface, enhanced privacy settings, and a pinnable Outlook sidebar, any older version of our legacy reporting add-in must be completely removed first.
This is because versioning rules dictate that a manifest must share the exact same ID to update seamlessly, and legacy platforms require a clean environment to completely overwrite old configuration parameters, your Microsoft 365 Global Administrator must execute this clean uninstallation process before uploading the new XML 2.0 manifest. Please see our guide.

Standard Installation & Deployment Workflow

To deploy across your enterprise, your Microsoft 365 global administrator must execute the following steps:

Log into your NINJIO Admin Platform and ensure the phishing reporting module is toggled ON.
Navigate to branding parameters, upload your preferred organizational logo, and configure your Popup Theming palette.
Customize your manifest download settings by specifying your preferred Outlook DisplayName (up to 25 approved alphanumeric characters) and choosing your manifest view variant (Sidepane or Popup).
Click Download Manifest to generate your organization's custom XML file.

How to Customize & Brand the XML 2.0 Reporter Button:

To see more step-by-step instructions in detail, please click here to see our guide.

How to deploy the XML 2.0 Reporter Button:

Access your Microsoft 365 Admin Center and navigate to the Integrated Apps section.
Choose Deploy Add-in, select Upload custom apps, and upload the custom XML file you generated.
Assign user deployment scopes to Everyone, set your implementation behavior method to Fixed, and save the permissions.

Related to