# (L1) Ensure users can report security concerns in Teams

(L1) Ensure users can report security concerns in Teams. A Maester check for Teams, Messaging.

Source: https://maester.dev/docs/tests/CIS.M365.8.6.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/henrikpiecha" title="Henrik Piecha · Original author"><img src="https://github.com/HenrikPiecha.png" alt="Henrik Piecha" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/merill" title="Merill Fernando · Co-contributor"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/henrikpiecha">Henrik Piecha</a> with <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Teams · Messaging · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.8.6.1
```

## Overview

8.6.1 (L1) Ensure users can report security concerns in Teams

User reporting settings allow a user to report a message as malicious for further analysis. This recommendation is composed of 3 different settings and all be configured to pass:

* **In the Teams admin center:** On by default and controls whether users are able to report messages from Teams. When this setting is turned off, users can't report messages within Teams, so the corresponding setting in the Microsoft 365 Defender portal is irrelevant.
* **In the Microsoft 365 Defender portal:** On by default for new tenants. Existing tenants need to enable it. If user reporting of messages is turned on in the Teams admin center, it also needs to be turned on the Defender portal for user reported messages to show up correctly on the User reported tab on the Submissions page.
* **Defender - Report message destinations:** This applies to more than just Microsoft Teams and allows for an organization to keep their reports contained. Due to how the parameters are configured on the backend it is included in this assessment as a requirement.

#### Rationale

Users will be able to more quickly and systematically alert administrators of suspicious malicious messages within Teams. The content of these messages may be sensitive in nature and therefore should be kept within the organization and not shared with Microsoft without first consulting company policy.

>Note
>
>* The reported message remains visible to the user in the Teams client.
>* Users can report the same message multiple times.
>* The message sender isn't notified that messages were reported.

#### Impact

Enabling message reporting has an impact beyond just addressing security concerns. When users of the platform report a message, the content could include messages that are threatening or harassing in nature, possibly stemming from colleagues.
Due to this the security staff responsible for reviewing and acting on these reports should be equipped with the skills to discern and appropriately direct such messages to the relevant departments, such as Human Resources (HR).

#### Remediation action

1. Navigate to [Microsoft Teams Admin Center](https://admin.teams.microsoft.com).
2. Select **Settings & policies** > **Global (Org-wide default) settings**.
3. Select **Messaging** to open the **messaging settings** section.
4. Set **Report a security concern** to **On**.
5. Next, navigate to [Microsoft 365 Defender](https://security.microsoft.com).
6. Click on **Settings** > **Email & collaboration** > **User reported settings**.
7. Scroll to **Microsoft Teams**.
8. Check **Monitor reported messages in Microsoft Teams** and **Save**.
9. Set **Send reported messages to:** to **My reporting mailbox only** with reports configured to be sent to authorized staff.

##### PowerShell

1. Connect to Teams PowerShell using `Connect-MicrosoftTeams`.
2. Connect to Exchange Online PowerShell using `Connect-ExchangeOnline`.
3. Run the following cmdlet:

```powershell
Set-CsTeamsMessagingPolicy -Identity Global -AllowSecurityEndUserReporting $true
```

1. To configure the Defender reporting policies, edit and run this script:

```powershell
$usersub = "userreportedmessages@fabrikam.com" # Change this.
$params = @{
    Identity = "DefaultReportSubmissionPolicy"
    EnableReportToMicrosoft = $false
    ReportChatMessageEnabled = $false
    ReportChatMessageToCustomizedAddressEnabled = $true
    ReportJunkToCustomizedAddress = $true
    ReportNotJunkToCustomizedAddress = $true
    ReportPhishToCustomizedAddress = $true
    ReportJunkAddresses = $usersub
    ReportNotJunkAddresses = $usersub
    ReportPhishAddresses = $usersub
}
Set-ReportSubmissionPolicy @params
New-ReportSubmissionRule -Name DefaultReportSubmissionRule -ReportSubmissionPolicy DefaultReportSubmissionPolicy -SentTo $usersub

```

#### Related links

* [Microsoft Teams Admin Center](https://admin.teams.microsoft.com)
* [Microsoft 365 Defender](https://security.microsoft.com)
* [User reported settings in Microsoft Teams](https://learn.microsoft.com/defender-office-365/submissions-teams?view=o365-worldwide)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 554](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.8.6.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Teams |
| Related products | Defender |
| Feature | Messaging |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.6.1 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:8.6.1 |
| PowerShell test | [Test-MtCisTeamsReportSecurityConcerns](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.6.1.ps1) |
| Services | Teams, ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.8.6.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.6.1.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.8.6.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.6.1.md)