ℹ️ Info
Part of the Getting Started guide, Step 3. Set up the reporting path.
The revel8 Reporting Button is an Outlook add-in that lets employees report suspicious emails in one click. Simulation reports are handled inside revel8; real emails are forwarded to the address you choose (for example your SOC mailbox). This guide walks an admin through installing the add-in and setting it up end to end.
📝 Note
This guide covers Microsoft 365 / Exchange Online. If your mailboxes run on on-premises Exchange, where the mailboxes are still on-premises, contact revel8 to enable on-premises support before you start.
Before you begin
Have these ready before you start:
Microsoft 365 Global Admin access, to install the add-in and connect your tenant.
Access to the revel8 platform as CISO / Admin, under Settings → Integrations → Outlook Reporting.
A forwarding address for real reports (a SOC mailbox, security distribution group, or ticketing/SIEM ingestion address).
1. Download the manifest
In the revel8 platform, open Settings → Integrations → Outlook Reporting.
Click Download manifest to save
outlook-manifest.xmlto your computer.
Don't rename the file. Microsoft matches the add-in on its manifest.
2. Install the manifest in the Microsoft 365 admin center
Admin permissions are required for this step.
Go to the Microsoft 365 Admin Center (
admin.microsoft.com) and open Settings → Integrated apps.Select Upload custom apps.
In the Deploy New App wizard, set App type to Office Add-in, choose Upload manifest file (.xml) from device, click Choose file, select the
outlook-manifest.xmlyou downloaded, and click Next.On the Users step, choose who receives the add-in. For a first install, deploy to your own admin account only to test it. After testing, redeploy to a security group, specific teams, or all employees. Click Next.
Review the settings and click Finish deployment. The add-in then appears under Deployed apps.
📝 Note
Microsoft can take up to 72 hours to show the button in user mailboxes, though it usually appears within 24. A Status: OK in the admin center only means the deployment is configured, not that users can see the button yet.
3. Connect your Microsoft tenant to revel8
Back on the Outlook Reporting page in revel8, the status reads Not connected to Microsoft tenant until you complete this step.
Click Connect to Microsoft.
Sign in with a Microsoft 365 Global Admin account.
Grant the requested permissions.
Once connected, the status turns green and shows Connected to Microsoft tenant with your Tenant ID, and revel8 links reported emails from your tenant to your organization. Use Re-connect to Microsoft if you ever need to refresh the connection.
When you connect, revel8 requests these Microsoft Graph permissions. Each is scoped to the emails a user actively reports.
Permission | Purpose |
| Reads basic profile information of the signed-in user. |
| Access to standard profile data (name, display name). |
| Enables sign-in via OpenID Connect. |
| Reads and moves the reported email within the user's mailbox (for example to Junk or Deleted Items). |
| The same, for shared mailboxes such as team inboxes. |
| Forwards the reported email to the forwarding address you configure below. revel8 does not send emails to itself. |
| The same forwarding function from shared mailboxes. |
💡 Tip
Permissions are scoped strictly to emails a user actively reports with the Reporting Button. There is no automatic scanning or reading of mailboxes, and forwarded reports go only to the address you configure. revel8 never receives end-user mail content directly.
4. Set the forwarding configuration
On the Outlook Reporting page, find the forwarding section. Reported non-simulation emails are forwarded to the addresses you set here, using the subject prefix you set. The forwarded email includes metadata about the reported message in the body and the original message attached as an EML file.
Set the Email subject prefix that real reports are sent with (for example
[Revel8 Report]).Under Send reports to, add each destination address (a SOC mailbox, security distribution group, or ticketing/SIEM address) and click Add.
Click Save settings.
⚠️ Warning
Without at least one forwarding address, the add-in will not work correctly. Set this before rolling the button out to employees.
This keeps the two report types separate: simulation reports are handled inside revel8, and real reports are forwarded to your SOC automatically.
Optional customizations
The Outlook Reporting page has two optional sections to tailor the report email and the button. The defaults work fine, so adjust these only if you need to.
Email template: set the Timezone used for report timestamps, and toggle Forward as attachment (send the original as an attachment, or forward it directly), Set EML filename (name the attached original), and Use Custom Report Email (replace the standard report body with your own text). Click Save settings.
Button icon: upload your own PNG, JPG, or JPEG to replace the default revel8 icon, then click Save changes. Use Remove to restore the default.
Troubleshooting and FAQ
What happens when someone reports an email?
What happens when someone reports an email?
There are two separate paths. A revel8 simulation shows the user an instant confirmation, and only the report event reaches the revel8 platform. Any other email is forwarded to the mailbox you configured (your Service Desk or SOC) and does not reach revel8 at all. For real reports, your own mail-flow logs are the source of truth, not the revel8 platform.
The button is greyed out
The button is greyed out
The button is only active when the email is open or shown in the reading pane. In list view without a preview it stays greyed out. Open the email or turn on the reading pane.
Reporting from a shared or delegate mailbox fails
Reporting from a shared or delegate mailbox fails
Forwarding a report needs a send permission on that mailbox, Send As or Send on Behalf, not just Inbox access. A delegate with Inbox-only access can trigger the forward, but the follow-up move of the reported mail then fails. Check how the mailbox is permissioned.
Reported emails aren't arriving at our security mailbox
Reported emails aren't arriving at our security mailbox
This is usually mail flow, not the button. Common causes are a quarantine or anti-spam policy on the destination mailbox, a tenant policy blocking automatic forwarding to external domains, or whitelisting that wasn't carried over after an Exchange migration. Where forwarding can't be allowed, adding the address as a copy recipient instead of a redirect can help.
Where does the button appear, and what about mobile?
Where does the button appear, and what about mobile?
The button sits under Add-ins at the top right of the ribbon. Microsoft does not allow it to replace or sit next to the native Report button. On the Outlook mobile apps it's only reachable through the three-dot menu, so mobile-heavy groups may use it less.