ThreatSubmission.Read.All
Exchange.ManageAsApp (report button policy)
— application permissions, granted to the app registration with admin consent.
Licence: Exchange Online Protection; SOC review actions need Defender for Office 365.
Endpoints:
GET /beta/security/threatSubmission/emailThreats (30 days) · Get-ReportSubmissionPolicy
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
User-reported Phishing Backlog
When users press Report phishing, somebody has to look. This report lists what users reported in the last 30 days that nobody has reviewed yet - first the messages Microsoft has already confirmed as phishing or malware - and shows where the report button sends reports.
Loading...