Outlook Add-in

The PhishSpot Outlook add-in puts a Report Phishing button on every email you read. One click sends the message (body, headers, attachments) to your PhishSpot account’s Reported Messages list. No forwarding to a special address, no manual copy-paste.

This page is for end users. If you’re an admin rolling the add-in out to a whole organisation, see Outlook Add-in: Central Deployment.

20.1 What you need

• Outlook on the web, Outlook for Windows or Mac, or the new Outlook for Windows.
• A PhishSpot Contact account at your organisation (your IT team can create one for you if you don’t have one).
• A few minutes to install the add-in and pair it.

Version 1.3 adds Outlook for iOS / Android for Microsoft 365 mailboxes. Install the updated manifest through your administrator. Older Windows Outlook clients and mobile clients may ask you to connect your Microsoft 365 mailbox before the first complete report. Local Exchange requires the separate administrator deployment described in the central deployment guide.

20.2 Install the add-in

1. Download the sideload package: phishspot-outlook-sideload-v1.3.0.zip.
2. Unzip it. You’ll get a manifest.xml, a folder of icons, and a README.md with click-by-click instructions for each Outlook variant.
3. In Outlook, open Get Add-ins → My add-ins → Add a custom add-in → Add from File… and pick manifest.xml.
4. Confirm the install dialog. The Report Phishing button appears on the message-read ribbon.

If your IT team has already deployed the add-in centrally for everyone, skip the install — you’ll see the button automatically.

20.3 Pair the add-in (one-time)

The first time you click Report Phishing, the add-in shows a 6-digit code in the PhishSpot task pane on the right side of Outlook:

1. Open https://platform.phishspot.com/guest/activation/new in a browser (the here link in the task pane will take you straight there). Once signed in, you’ll see the Connect your Outlook add-in page:

   

2. Sign in with the same email your IT team registered for PhishSpot.

3. Type or paste the 6-digit code shown in the task pane.

4. Pick which account you’re pairing with (if you belong to more than one), optionally give the device a name, then click Pair this device.

After pairing, the selected message is reported automatically. If Microsoft sign-in is required, follow the steps below. Outlook stores the pairing in your mailbox settings; it may follow you to other Outlook clients for the same mailbox.

20.4 Report a suspicious email

1. Open the email you suspect is phishing.
2. Click Report Phishing in Outlook. The panel opens and reports the selected message automatically; no second click is needed after setup.
3. The task pane briefly shows “Reporting…” while the message is sent.
4. A thank-you screen confirms the report:

If prompted, choose Connect Microsoft 365 mailbox, then Open Microsoft sign-in. Sign in with the same mailbox registered in PhishSpot and grant the requested permission. Return to Outlook and select Retry report. Your organisation may require an administrator to approve this permission.

Click Close to dismiss the task pane.

The report appears in your organisation’s Reported Messages list. Your security team will review it.

20.5 What gets sent

• The sender’s email address and display name
• The subject and the message body (HTML + plain text)
• The full internet headers
• Available file attachments; the report marks incomplete captures when Outlook cannot provide an attachment or a size limit is reached. Microsoft 365 fallback retains the original EML, including attachments (up to 25 MB).
• A timestamp and the message’s Internet Message ID (for deduplication)

The PhishSpot device token can submit reports only. When Microsoft 365 fallback is needed, you separately grant delegated Mail.Read, User.Read, and offline_access. Microsoft grants read access to your mailbox; PhishSpot uses it to collect the selected reported message, and does not request permission to send or modify mail. Microsoft credentials stay encrypted on the server. The add-in receives only the report confirmation.

20.6 The “Update available” banner

Each time you click the button the add-in checks its version against the server. Two outcomes:

• An update is available — soft banner; you can still report. Ask your IT team to push the new version when convenient.
• Update required — hard block; the button is hidden until the add-in is updated. This happens only when an old version is incompatible with a server change (rare).

20.7 Unpair / sign out

Open the menu, choose Sign out, and confirm. PhishSpot revokes the device token and removes any associated Microsoft mailbox credentials, then clears the Outlook pairing. An internet connection is required. Account administrators can separately remove delegated mailbox access in Settings → Integrations → Outlook mailbox connections.