How to Submit an Email Flagged as High Confidence Phishing to Microsoft
Log into the Defender console.
On the left side pane, click the drop-down menu next to Actions & Submissions and select Submissions.
By default, it will open to the Email tab. Click Submit to Microsoft for analysis.
The Submit to Microsoft for analysis menu will pop up. For Emails you need the network message ID, you can get this info by searching for the email in Explorer.
The network message ID will be in the Email details, for example:
After you enter in the network message ID, select the recipient who has the issue with the false positive.
After you select the affected user, check “I’ve confirmed it’s clean” and then click next.
Select Allow this message, by default it will remove the entry after 30 days. This will give Microsoft enough time to analyze the email.
Click Submit.