Back to Checks
m365

Defender report submission policy uses customized addresses for junk, not junk and phish, and chat reports are sent only to a customized address

defender_chat_report_policy_configured
Service: defenderSeverity: medium
OfficialBuilt-inVerified
Categories:email-securitye3
Resource Type:NotDefined

Microsoft Defender for Office 365 user-reported settings ensure junk, not-junk, and phish reports are sent to customized addresses with valid destinations, and that Teams chat reports route to customized addresses while direct chat reporting to Microsoft is disabled.

Prowler logoProwlerprowler-provider-m365

Risk

Misrouted or disabled user reports reduce visibility into Teams threats, delaying containment. Attackers can keep distributing phishing links or malicious files, causing credential theft (confidentiality), message manipulation (integrity), and channel disruption from ongoing spam (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks defender_chat_report_policy_configured

Recommendation

Send all user-reported junk, not-junk, and phish to monitored custom mailboxes and enable Teams chat reporting to those addresses, keeping direct chat submissions to Microsoft disabled. Apply least privilege to reviewer access, establish a triage workflow, and integrate alerts for defense in depth.

Remediation

CLI

Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -ReportJunkToCustomizedAddress $true -ReportNotJunkToCustomizedAddress $true -ReportPhishToCustomizedAddress $true -ReportJunkAddresses <EMAIL_ADDRESS> -ReportNotJunkAddresses <EMAIL_ADDRESS> -ReportPhishAddresses <EMAIL_ADDRESS> -ReportChatMessageEnabled $false -ReportChatMessageToCustomizedAddressEnabled $true

Other

1Go to Microsoft 365 Defender: https://security.microsoft.com
2Navigate to Settings > Email & collaboration > User reported settings
3In Reported message destinations (Outlook):
4- Turn on Send Junk to a customized address and enter <EMAIL_ADDRESS>
5- Turn on Send Not junk to a customized address and enter <EMAIL_ADDRESS>
6- Turn on Send Phish to a customized address and enter <EMAIL_ADDRESS>
7In Microsoft Teams section:
8- Turn off Monitor reported messages in Microsoft Teams
9- Turn on Send reported Teams messages to a customized address

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.defender.defender_client import defender_client


class defender_chat_report_policy_configured(Check):
    """Check if Defender report submission policy is properly configured for Teams security reporting.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for Defender report submission policy settings.

        This method checks if Defender report submission policy is properly configured for Teams security reporting.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        report_submission_policy = defender_client.report_submission_policy

        if report_submission_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=report_submission_policy,
                resource_name="Defender Security Reporting Policy",
                resource_id="defenderSecurityReportingPolicy",
            )

            defender_settings_valid = (
                report_submission_policy.report_junk_to_customized_address
                and report_submission_policy.report_not_junk_to_customized_address
                and report_submission_policy.report_phish_to_customized_address
                and report_submission_policy.report_junk_addresses
                and report_submission_policy.report_not_junk_addresses
                and report_submission_policy.report_phish_addresses
                and not report_submission_policy.report_chat_message_enabled
                and report_submission_policy.report_chat_message_to_customized_address_enabled
            )

            if defender_settings_valid:
                report.status = "PASS"
                report.status_extended = "Defender report submission policy is properly configured for Teams security reporting."
            else:
                report.status = "FAIL"
                report.status_extended = "Defender report submission policy is not properly configured for Teams security reporting."

            findings.append(report)

        return findings

References