The phishing report button for Outlook On-Premise lets users report suspicious emails directly from Outlook in corporate environments that do not use Exchange Online or Azure AD.
When a user reports an email, the system sends the information to Whalemate for analysis or forwards it to the email address configured by the organization.
Let users report suspicious emails directly from Outlook.
Centralize phishing reports within the awareness program.
Make incident analysis easier for the security team.
Integrate phishing reporting with internal tools such as SOC or SIEM.
Measure reporting behavior in phishing campaigns.
The add-in design is based on a simple client–server architecture, with no dependencies on Microsoft cloud services.
Main components
Outlook Add-in (Client)
Whalemate Backend (Server)
There are no intermediate components or third-party services.
Type: Office Add-in (MailApp)
UI: Task Pane
Technology: Office.js
Execution: Outlook client (On-Premise)
The add-in is triggered by a manual user action ("Report Phishing") on a selected email.
The add-in can only access the information exposed by Office.context.mailbox.item, including:
Sender email address
Sender domain
Email address of the reporting user
Date and time of the report
Date and time the suspicious email was sent
Email body (HTML and plain text)
Links contained in the email body
Because of the On-Premise context:
❌ No access to full email headers
❌ No access to attachments in binary form
❌ No Microsoft Graph
❌ No Azure AD / MSAL
❌ No strong-identity JWT tokens are generated
These restrictions make it impossible, for example, to correlate the report with previous campaigns based on custom headers.
Receiving endpoint
POST https://back.whalemate.com/api/public/reported-email-microsoft-webhook
Backend responsibilities
When it receives a report, the backend:
Logs the report event.
Stores the information of the reported email.
Displays the report in Whalemate's SIEM interface.
Forwards the information to the email addresses configured by the organization, if required.
Logical flow of the report:
The user selects a suspicious email in Outlook.
They press the Report Phishing button.
The add-in:
Retrieves the selected item.
Extracts the allowed metadata and content.
Sends the payload to the Whalemate backend over HTTPS.
The backend processes and logs the report.
The user receives visual feedback on success or error.
[User]
|
v
[Outlook On-Prem]
|
| Office Add-in (Office.js)
v
[Report Phishing button]
|
| HTTPS POST
v
[Whalemate Backend]
|
+--> SOC / UI
+--> Forwarding to configured email addresses
Platform / Client
On-Premise Add-in
Add-in with MSAL (M365)
Outlook Windows 2010 or earlier
❌ Not compatible
❌ Not compatible
Outlook 2013 (SP1)
✅ Compatible
❌ Not compatible
Outlook 2016
✅ Compatible
✅ Compatible
Outlook 2019
✅ Compatible
✅ Compatible
Outlook 2021
✅ Compatible
✅ Compatible
Outlook Microsoft 365 (Windows)
✅ Compatible
✅ Compatible
Outlook on the Web (OWA)
✅ Compatible
✅ Compatible
Outlook Mac (Office 2016+)
❌ Not compatible
✅ Compatible
Windows Mail / Windows 10–11 Mail
❌ Not compatible
❌ Not compatible
Apple Mail / Generic POP–IMAP Clients
❌ Not compatible
❌ Not compatible
Client Requirements
Outlook with Office Add-ins support (Office.js)
Allow installation of custom add-ins
Outbound HTTPS connectivity to the Whalemate backend
Backend Requirements
Publicly accessible HTTPS endpoint
Support for receiving JSON payloads
Secure storage of the reported information
The add-in does not run native code on the client.
It does not persist information locally.
Communication happens exclusively over HTTPS.
No Microsoft credentials or authentication tokens are used.
Data access is limited to the email selected by the user.
‼️This add-in was designed specifically for On-Premise environments, prioritizing simplicity, compatibility, and security, within the technical limitations imposed by the Outlook extensibility model in those environments.
In the Outlook On-Premise implementation, the report includes the following email data:
Sender email address
Sender domain
Email address of the reporting user
Date and time of the report
Date and time the suspicious email was sent
Email body (HTML and raw)
Links present in the email
Because of on-premise environment limitations, full headers and attachments are not included, since those APIs are not available without Microsoft Graph.
Not necessarily. In the On-Premise version, the add-in has no access to the email headers.
This makes it impossible to identify the campaign_id that Whalemate inserts into the X-Mailgun-Tag header, which is the mechanism used to link a report to a specific campaign.
For this reason:
The user's report event can be logged correctly.
But it cannot always be associated automatically with a campaign, so it may not show up as "Reported" in that campaign's analytics.
This is a limitation inherent to On-Premise mode without Microsoft Graph.
No. In the On-Premise implementation, the add-in has no access to Microsoft Graph or Exchange APIs, so it cannot perform actions on the user's mailbox, such as:
deleting emails
moving emails to spam
applying remote actions on the message
For this reason, physically deleting the email from the SIEM is not available in the On-Premise version.
That functionality requires integration with Microsoft Graph or Exchange Online.