User-reported Phishing Backlog
The question it answers: Which user-reported phishing messages of the last 30 days has nobody reviewed yet?
When users press Report phishing, somebody has to look. This report lists what users reported in the last 30 days that nobody has reviewed yet - first the messages Microsoft has already confirmed as phishing or malware - and shows where the report button sends reports.
At a glance
Section titled “At a glance”| Where in the app | Exchange Online › Mail Security & Hygiene › User-reported Phishing Backlog |
| Workload | Exchange Online |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | Exchange Online Protection; SOC review actions need Defender for Office 365. |
| Report id (API and MCP) | exchange.hygiene.reported-phishing |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Submission | Category | Text |
| Subject | Subject | Link |
| Check | Setting | Text |
| Value | Value | Text |
| Finding | Finding | Text |
| Sender / recipient | Detail | Text |
| Reported | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Exchange Online Protection; SOC review actions need Defender for Office 365.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
ThreatSubmission.Read.All | Microsoft Graph | Read all of the organization’s threat submissions | |
Exchange.ManageAsApp | Office 365 Exchange Online | Manage Exchange As Application | report button policy |
Data sources it reads
GET /beta/security/threatSubmission/emailThreats (30 days)Get-ReportSubmissionPolicy
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/exchange.hygiene.reported-phishing?size=100An AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.reported-phishing. The client needs the Read grant for Exchange Online. See Using the API.