Phishing Report Button Compatibility Matrix

Read this article in: English, German

You’re viewing the documentation for the new Beta version of the Phishing Report Button. Feel free to take a look! Consult the regular PRB documentation if you need help with the non-Beta version.

Below is a detailed breakdown of the Phishing Report Button’s compatibility for primary and shared inboxes in Outlook.

Primary inboxes compatibility matrix

The Phishing Report Button uses Exchange Web Services (EWS) or the Outlook Graph API to retrieve data from the user’s mailbox. The following sections state the availability of the APIs for all supported Exchange server/Outlook client combinations and their effect on how reported email are forwarded.

Please note: For all Exchange Online environments (including hybrid deployments) we can only support Graph API and for all Exchange On-Premise servers we can only support EWS.

Using Exchange on premise and EWS: EWS must be enabled and must be exposed to the Internet. This Microsoft requirement is further explained here.

Windows

MacOS

Other

Differences in the email report via EWS and Graph

It is important to understand the impact using EWS vs Graph has on the format in which reported emails are forwarded to the inbox you specify. Email reports can be provided as an .eml file or in a more parsed file format called “split mode”. Depending on the available API and the chosen configuration, the two formats will be appear differently as shown below.

¹ _{Connected to Exchange Online (hybrid deployment, Mailboxes synced or managed by Microsoft)}

² _{If the email contains attachments}

_{3 Please note: In Outlook 2013–2019, when users open the Phishing Report button for the first time, they’ll be prompted via a pop-up to sign in to their email - this only needs to be done once. For all future uses, the same pop-up will still appear but users will be automatically signed in within a few seconds. This behaviour is due Outlook 2013–2019 not supporting Microsoft Single Sign-On (SSO).}

Shared Inboxes compatibility matrix

The vast majority of email inboxes are so-called primary inboxes. They are used by a single person only as their primary inbox. However, there are some exceptions. This article explains Phishing Report Button compatibility within Outlook in these 2 scenarios:

1. Shared inboxes: These are inboxes that can be accessed by multiple people and are usually not associated with a single person. This is often used for teams or departments so that there is a single point of contact. Think support@company.com, for instance.

2. Shared folders / delegated access: In this scenario, a user might share access to their primary, individual inbox or a folder of their inbox with someone else (a “delegate”)

The Phishing Report Button can work in both scenarios, but technical limitations within Outlook limit compatibility based on your organization’s specific environment.

Microsoft offers no way for the Phishing Report Button add-in to determine the environment it is operating in, so you will have to verify this yourself.

EWS support is limited to on-premise Exchange environments and does not work properly with shared mailboxes. The reason for this is the Office JavaScript API (Office.js), which is provided by Microsoft and enables the Phishing Report Button to communicate with Outlook. Although it can authenticate the user correctly, it has no mechanism for recognizing that the user is working in the context of a shared mailbox rather than their primary inbox. It will therefore misinterpret all access attempts.

Helpful links

Microsoft - Implement shared folders and shared mailbox scenarios in an Outlook add-in