CIS.M365.8.6.1: Ensure users can report security concerns in Teams

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.8.6.1
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Teams
Related products	Defender
Feature	Messaging
Security area	Email and collaboration protection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 8.6.1 (L1, E5 Level 1)
Framework controls	cis-m365:8.6.1
MITRE ATT&CK	T1566
Reads from	Microsoft Teams

What this checks and how to fix it

8.6.1 (L1) Ensure users can report security concerns in Teams

User reporting settings allow a user to report a message as malicious for further analysis. This recommendation is composed of 3 different settings and all be configured to pass:

• In the Teams admin center: On by default and controls whether users are able to report messages from Teams. When this setting is turned off, users can’t report messages within Teams, so the corresponding setting in the Microsoft 365 Defender portal is irrelevant.
• In the Microsoft 365 Defender portal: On by default for new tenants. Existing tenants need to enable it. If user reporting of messages is turned on in the Teams admin center, it also needs to be turned on the Defender portal for user reported messages to show up correctly on the User reported tab on the Submissions page.
• Defender - Report message destinations: This applies to more than just Microsoft Teams and allows for an organization to keep their reports contained. Due to how the parameters are configured on the backend it is included in this assessment as a requirement.

Rationale

Users will be able to more quickly and systematically alert administrators of suspicious malicious messages within Teams. The content of these messages may be sensitive in nature and therefore should be kept within the organization and not shared with Microsoft without first consulting company policy.

Note

• The reported message remains visible to the user in the Teams client.
• Users can report the same message multiple times.
• The message sender isn’t notified that messages were reported.

Impact

Enabling message reporting has an impact beyond just addressing security concerns. When users of the platform report a message, the content could include messages that are threatening or harassing in nature, possibly stemming from colleagues. Due to this the security staff responsible for reviewing and acting on these reports should be equipped with the skills to discern and appropriately direct such messages to the relevant departments, such as Human Resources (HR).

Remediation action

1. Navigate to Microsoft Teams Admin Center.
2. Select Settings & policies > Global (Org-wide default) settings.
3. Select Messaging to open the messaging settings section.
4. Set Report a security concern to On.
5. Next, navigate to Microsoft 365 Defender.
6. Click on Settings > Email & collaboration > User reported settings.
7. Scroll to Microsoft Teams.
8. Check Monitor reported messages in Microsoft Teams and Save.
9. Set Send reported messages to: to My reporting mailbox only with reports configured to be sent to authorized staff.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Connect to Exchange Online PowerShell using Connect-ExchangeOnline.
3. Run the following cmdlet:

Set-CsTeamsMessagingPolicy -Identity Global -AllowSecurityEndUserReporting $true

1. To configure the Defender reporting policies, edit and run this script:

$usersub = "userreportedmessages@fabrikam.com" # Change this.
$params = @{
    Identity = "DefaultReportSubmissionPolicy"
    EnableReportToMicrosoft = $false
    ReportChatMessageEnabled = $false
    ReportChatMessageToCustomizedAddressEnabled = $true
    ReportJunkToCustomizedAddress = $true
    ReportNotJunkToCustomizedAddress = $true
    ReportPhishToCustomizedAddress = $true
    ReportJunkAddresses = $usersub
    ReportNotJunkAddresses = $usersub
    ReportPhishAddresses = $usersub
}
Set-ReportSubmissionPolicy @params
New-ReportSubmissionRule -Name DefaultReportSubmissionRule -ReportSubmissionPolicy DefaultReportSubmissionPolicy -SentTo $usersub

Related links

• Microsoft Teams Admin Center
• Microsoft 365 Defender
• User reported settings in Microsoft Teams
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 554

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: HenrikPiecha; contributors: merill. Open-source licences.