New-ReportSubmissionRule

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.

The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.

• Destructive cmdlets (for example, Remove-* cmdlets) have a built-in pause that forces you to acknowledge the command before proceeding. For these cmdlets, you can skip the confirmation prompt by using this exact syntax: -Confirm:$false.
• Most other cmdlets (for example, New-* and Set-* cmdlets) don't have a built-in pause. For these cmdlets, specifying the Confirm switch without a value introduces a pause that forces you acknowledge the command before proceeding.

The Enabled parameter specifies whether the rule is enabled or disabled. Valid values are:

• $true: The rule is enabled. This is the default value.
• $false: The rule is disabled.

After you create the rule, use the Enable-ReportSubmissionRule and Disable-ReportSubmissionRule cmdlets to enable or disable the rule.

The Name parameter specifies the name of the report submission rule. When the rule is automatically created, the name of the rule is DefaultReportSubmissionRule. We recommend using this value to avoid confusion.

The ReportSubmissionPolicy parameter specifies the report submission policy that's associated with this rule. The only available policy is named DefaultReportSubmissionPolicy.

The SentTo parameter specifies the email address of the reporting mailbox in Exchange Online where user reported messages are sent.

The value of this parameter is meaningful only if reporting in Outlook is enabled, and user reported messages are sent to a reporting mailbox as configured in the *-ReportSubmissionPolicy cmdlets (either of the following scenarios):

• Microsoft integrated reporting is enabled using Microsoft reporting tools in Outlook: -EnableThirdPartyAddress $false -ReportJunkToCustomizedAddress $true -ReportNotJunkToCustomizedAddress $true -ReportPhishToCustomizedAddress $true.
• Microsoft integrated reporting is enabled using third-party reporting tools in Outlook: -EnableReportToMicrosoft $false -EnableThirdPartyAddress $true -ReportJunkToCustomizedAddress $false -ReportNotJunkToCustomizedAddress $false -ReportPhishToCustomizedAddress $false.

If you set the email address of the reporting mailbox in the Microsoft Defender portal, the following parameters in the *-ReportSubmissionPolicy cmdlets are set to the same value:

• Microsoft integrated reporting using Microsoft reporting tools in Outlook: ReportJunkAddresses, ReportNotJunkAddresses, and ReportPhishAddresses (all three must be the same value).
• Microsoft integrated reporting using third-party reporting tools in Outlook: ThirdPartyReportAddresses.

When you use this cmdlet to set the email address of the reporting mailbox, the related parameter values in the *-ReportSubmissionPolicy cmdlets are not updated, which doesn't affect the functionality of the reporting mailbox. You should update the related values in the *-ReportSubmissionPolicy cmdlets for consistency and to avoid confusion.

The WhatIf switch simulates the actions of the command. You can use this switch to view the changes that would occur without actually applying those changes. You don't need to specify a value with this switch.