Check ID: defender_chat_report_policy_configured
Provider: Microsoft 365
Service: defender
Severity: MEDIUM
Categories: email-security, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Defender for Office 365 user-reported settings ensure junk, not-junk, and phish reports are sent to customized addresses with valid destinations, and that Teams chat reports route to customized addresses while direct chat reporting to Microsoft is disabled.

​
Risk

Misrouted or disabled user reports reduce visibility into Teams threats, delaying containment. Attackers can keep distributing phishing links or malicious files, causing credential theft (confidentiality), message manipulation (integrity), and channel disruption from ongoing spam (availability).

​
Recommendation

Send all user-reported junk, not-junk, and phish to monitored custom mailboxes and enable Teams chat reporting to those addresses, keeping direct chat submissions to Microsoft disabled. Apply least privilege to reviewer access, establish a triage workflow, and integrate alerts for defense in depth.

​
Remediation

Set-ReportSubmissionPolicy -Identity DefaultReportSubmissionPolicy -ReportJunkToCustomizedAddress true−ReportNotJunkToCustomizedAddresstrue -ReportNotJunkToCustomizedAddress true -ReportPhishToCustomizedAddress true -ReportJunkAddresses <EMAIL_ADDRESS> -ReportNotJunkAddresses <EMAIL_ADDRESS> -ReportPhishAddresses <EMAIL_ADDRESS> -ReportChatMessageEnabled false -ReportChatMessageToCustomizedAddressEnabled $true

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_chat_report_policy_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks