What to take away
Forwarding suspicious emails to a shared security mailbox strips headers and buries real attacks under simulation noise. Deploying a native Gmail Workspace add-on or Microsoft Outlook integrated add-in preserves message context, routes internal simulations automatically, and pairs AI pre-classification with human analyst verdicts and mail-server remediation.
1. Why "forward suspicious mail to IT" breaks down at 50+ employees
Asking employees to forward suspicious messages to a shared mailbox creates three operational problems: forwarding rewrites headers and drops authentication results (SPF, DKIM, DMARC), live HTML links stay clickable inside helpdesk tickets, and every phishing simulation campaign floods the IT queue with dozens of identical forwards.
A native Gmail or Microsoft Outlook report add-in captures the exact reported message on click, separates authorized simulations from external messages automatically, and gives employees immediate feedback when they spot a drill.
References: Google Workspace Admin Help - Install Google Workspace Marketplace apps for your domain · Microsoft Learn - Deploy add-ins in the Microsoft 365 admin center
2. Roll out the add-in in Google Workspace and Microsoft 365 with least privilege
Centralize deployment through Google Workspace Marketplace domain install or the Microsoft 365 Integrated Apps portal so the report button appears across desktop webmail and supported mobile clients without individual user setup.
Scrutinize the permissions requested by any reporting add-in before granting tenant-wide consent. Reporting a single clicked message should only submit that reported item and verify who reported it, not grant standing read/write access to every mailbox in the company.
| Platform | Deployment path | What to verify during pilot |
|---|---|---|
| Google Workspace (Gmail) | Google Admin (Apps, Google Workspace Marketplace apps, domain or OU install) | Button appears in Gmail right-side panel on web and mobile; test both simulation and external mail |
| Microsoft 365 (Outlook) | Microsoft 365 Admin Center (Settings, Integrated apps, centralized deployment) | Allow up to 24-72 hours for Microsoft propagation; authorize reporter verification scopes |
| Native vendor reporting coexistence | Check Defender User Reported Settings or Gmail native spam/phishing reporting rules | Avoid two competing report buttons with unclear names; tell staff which button to click |
References: Google Workspace Admin Help - Install Google Workspace Marketplace apps for your domain · Microsoft Learn - Deploy add-ins in the Microsoft 365 admin center · Elba Documentation - Report phishing add-in setup, AI suggestion, and triage
3. Route simulations automatically and keep AI triage distinct from final verdicts
When an employee reports a phishing simulation, record their catch immediately in campaign reporting rather than creating a manual SOC ticket. Reserve the analyst queue exclusively for unscheduled external emails.
AI pre-classification speeds up initial triage on real reports by distinguishing obvious marketing spam from credential-harvesting lures and BEC pretexts. Keep the AI confidence score and suggestion separate from the human analyst verdict so an uncertain model output never silently closes a targeted spear-phishing attempt or deletes legitimate customer mail.
References: Elba Documentation - Report phishing add-in setup, AI suggestion, and triage
4. Pair triage verdicts with mail-server purge and post-click SaaS checks
Verify whether your reporting tool modifies employee mailboxes or acts strictly as a triage and awareness workflow. When a reported message turns out to be a live credential or OAuth consent attack, recording a "Phishing" verdict in a triage queue does not by itself purge unread copies from other employees’ inboxes or revoke tokens if someone else already clicked.
Run two immediate follow-ups whenever you confirm a real attack: search and purge matching Message-ID or sender/subject pairs using Google Workspace Investigation Tool or Microsoft Defender Explorer, and check whether any targeted user created suspicious inbox-forwarding rules, OAuth grants, or external file links.
- Safe / legitimate mail: notify the reporter briefly so they know it is safe to proceed.
- Spam / bulk marketing: mark reviewed and keep your queue focused on actual threats.
- Confirmed phishing: purge matching messages in Google Admin or Defender, check post-click OAuth and inbox rules, and consider turning the sanitized lure into future awareness practice.
References: Elba Documentation - Report phishing add-in setup, AI suggestion, and triage · Microsoft Defender for Office 365 - Remediate malicious email delivered in Office 365
How Elba’s Gmail and Outlook phishing report add-ins work
Elba provides native Gmail and Microsoft Outlook phishing report add-ins. In Microsoft 365, administrators complete a dedicated Authorise employee reporting consent that verifies the reporting employee’s identity without granting Elba access to read employee mailboxes or the full directory. Reported Elba simulations are credited automatically to campaign results (awarding +5 Security Leaderboard points) instead of entering the analyst queue.
All non-simulation reports land in Elba’s Reported emails queue (Unread or Read), with optional real-time admin alerts in Slack, Microsoft Teams, or Google Chat (email is intentionally not used for this alert, and reported subject lines are rendered as inert text). Each report displays an AI suggestion (Safe, Spam, or Phishing with a confidence score out of 1) alongside a separate human Analyst verdict and UTC verdict history; recording a verdict in Elba does not delete or quarantine mail inside the employee’s mailbox. From any reported email, admins can also select Create simulation draft to generate a sanitized training template that strips active scripts and remote resources, replaces links with safe simulation placeholders, and redacts sender domains, URL-like filenames, and phone numbers for human review before launch.
References: Elba Documentation - Report phishing add-in setup, AI suggestion, and triage · Elba Documentation - Phishing simulations and campaign reporting
Phishing report button deployment & triage checklist
Your checks stay on this page and reset when you reload it.
Common questions
Does Elba’s Outlook add-in require full read/write access to employee mailboxes?
No. In Microsoft 365, Elba’s Authorise employee reporting step requests only the minimal permission needed to verify the reporting user when they submit an email through the add-in, without granting standing mailbox or directory read access.
Does marking a reported email as Phishing in Elba delete it from the user’s inbox?
No. Recording an Analyst verdict (Safe, Spam, or Phishing) in Elba updates triage status and UTC history inside Elba, and does not quarantine, move, or delete messages in Gmail or Exchange Online. Use Google Workspace Investigation Tool or Microsoft Defender Explorer when you need tenant-wide message removal.
What happens when an employee reports one of Elba’s own phishing simulations?
Elba recognizes its own simulation automatically, records the report on the campaign dashboard, awards +5 points when the Security Leaderboard is enabled, and keeps the simulation out of the Reported emails queue so analysts only review real external messages.
Can we turn a real reported phishing email into a safe simulation for the rest of the team?
Yes. Elba’s Create simulation draft action strips scripts and remote tracking resources, replaces links with safe training placeholders, and redacts domains, URL-like attachment names, and phone numbers. Always review the body copy to remove any remaining employee names or context before scheduling a campaign.
Sources & further reading
Primary documentation used to review this guide. Product settings and edition requirements can change; check the linked documentation before making changes.
- Google Workspace Admin Help - Install Google Workspace Marketplace apps for your domain
- Microsoft Learn - Deploy add-ins in the Microsoft 365 admin center
- Elba Documentation - Report phishing add-in setup, AI suggestion, and triage
- Microsoft Defender for Office 365 - Remediate malicious email delivered in Office 365
- Elba Documentation - Phishing simulations and campaign reporting