ℹ️ Info
Part of the Getting Started guide, Step 3. Set up the reporting path.
The revel8 Reporting Button is an Outlook add-in that lets employees report suspicious emails in one click. This guide is for Exchange (on-premises). If your mailboxes are in Microsoft 365 / Exchange Online, use that guide instead. What matters is where your mailboxes live, not where your accounts live: a tenant can use Entra ID for identity and still run every mailbox on Exchange, which is an Exchange setup here.
On Exchange, the mail actions run in Outlook against your own server over EWS. Simulation reports go to revel8; real emails are forwarded to a mailbox you choose.
📝 Note
revel8 turns on Exchange (on-premises) support per organization. Contact revel8 to enable it before you start.
Before you begin
Get these in place before the setup session. Missing one is the usual reason a setup call stalls.
On the server:
Exchange 2016 or later. Earlier versions are not supported.
EWS enabled and reachable from the internet. The add-in's mail actions run in Outlook against your own server over EWS, so the endpoint has to be published externally, not only inside your network.
A valid authentication certificate, so the server can issue valid identity tokens. An expired certificate is a common cause of tokens being rejected. See Microsoft's Maintain the OAuth certificate.
OAuth for EWS enabled.
On your side:
Your Exchange administrator in the session, with ECP / Exchange admin rights active, not just the project contact.
A forwarding mailbox for real (non-simulation) reports.
A decision on token verification (step 3): either your
/autodiscover/metadata/json/1endpoint is reachable from the internet, or you upload the server's OAuth signing certificate.
1. Download the manifest
In the revel8 platform, open Settings → Integrations → Outlook Reporting and click Download manifest to save outlook-manifest.xml. Don't rename the file.
2. Install the manifest in the Exchange Admin Center
Install the manifest through your Exchange Admin Center to distribute the add-in to users:
Sign in to the Exchange Admin Center and go to Organization → Add-ins.
Click the + and choose Add from file.
Select the
outlook-manifest.xmlyou downloaded, then set who receives the add-in.
The exact labels vary slightly by Exchange version. On-premises distribution is usually quick; if a later manifest change isn't showing, check client caching and restarts before assuming the deployment failed.
3. Configure Exchange
On the Outlook Reporting page, open Configure on-premise Exchange. revel8 needs to verify the tokens your server issues, so that your button configuration is released only to your users.
Enter your Exchange server domain: the host that serves
/autodiscover/metadata/json/1(for examplemail.example.com).Choose how revel8 verifies tokens:
Reachable autodiscover endpoint (recommended): leave the certificate empty. revel8 fetches the signing key from
https://<your-domain>/autodiscover/metadata/json/1, which must be reachable from outside your network. Lower maintenance.Signing certificate: if that endpoint isn't reachable, upload the server's OAuth public-key certificate (PEM or base64-encoded X.509:
.cer,.crt,.pem).
Click Save.
The domain is required in both cases. The certificate doesn't replace it.
📝 Note
If you upload a certificate, keep it current on the revel8 platform: renew it here whenever it's renewed on the server, otherwise reporting stops.
4. Set the forwarding configuration
On the Outlook Reporting page, find the forwarding section. Reported non-simulation emails are forwarded to the addresses you set here, using the subject prefix you set. The forwarded email includes metadata about the reported message in the body and the original message attached as an EML file.
Set the Email subject prefix for real reports (for example
[Revel8 Report]).Under Send reports to, add each destination address (a SOC mailbox, security distribution group, or ticketing/SIEM address) and click Add.
Click Save settings.
⚠️ Warning
Without at least one forwarding address, the add-in will not work correctly. Set this before rolling the button out to employees.
Optional customizations
The Outlook Reporting page has two optional sections. The defaults work fine, so adjust these only if you need to.
Email template: set the Timezone used for report timestamps, and toggle Include body content in forward (on adds an addin-generated summary or your custom text to the forwarded report; off forwards it without added body). Click Save settings.
Button icon: upload your own PNG, JPG, or JPEG to replace the default revel8 icon, then click Save changes. The button's display name and logo come from the manifest, so changing those needs a new manifest and redeployment.
Troubleshooting and FAQ
What happens when someone reports an email?
What happens when someone reports an email?
A revel8 simulation shows the user an instant confirmation, and only the report event reaches the revel8 platform. Any other email is forwarded from the client, over EWS, to the mailbox you configured. It does not reach revel8, so for real reports your own mail-flow logs are the source of truth.
Where does the button appear?
Where does the button appear?
The button sits under Add-ins at the top right of the ribbon. Microsoft does not allow it to replace or sit next to the native Report button.