Here you'll learn how you can deploy the Phish Alert Button for Outlook within your organisation once you have finished set up and testing.
In this article you find:
Which versions of Outlook does this cover?
You don't need separate instructions for each version of Outlook. Deploy the Phish Alert Button once, using the Microsoft 365 or Exchange steps below. It will then appear in the Outlook apps your users sign in to with that mailbox:
Outlook on the web and new Outlook: reload the page or app to see the button. It appears in the actions menu on each email.
Outlook desktop (classic Outlook): restart Outlook to see the button. It appears in the ribbon.
Outlook mobile: restart the app to see the button.
Deploying through the Microsoft 365 admin centre
Your users need an Exchange Online mailbox and must sign in to Outlook with their work account. Microsoft supports these Outlook versions:
Microsoft 365 Apps, version 1701 or later
Office 2019 (version 1808 or later) and later one-off purchase versions, such as Office 2021 and Office 2024
Outlook for Mac (Office 2016 for Mac version 16.0.9318 or later)
Outlook for iOS version 2.75.0 or later, and Outlook for Android version 2.2.145 or later
If your mailboxes are on an on-premises Exchange server, you can't deploy through the Microsoft 365 admin centre. Use the Exchange steps instead.
Deploying through Exchange 2013/2016/2019 (on-premises)
The button appears in Outlook desktop and Outlook on the web for mailboxes on your Exchange server. It doesn't appear in Outlook mobile, because Microsoft doesn't support add-ins in Outlook for iOS or Android with on-premises Exchange accounts.
Note: If you turned on Retrieve Message Data via the MS Graph API on Behalf of a User using SSO in your Phish Alert settings, this feature only works in Outlook versions that support Microsoft's single sign-on for add-ins: Outlook on Windows version 2008 or later (Microsoft 365 or retail), Office 2021 version 2108 or later, Office 2024, and Outlook for Mac version 16.40 or later. It doesn't work in Outlook mobile or in Office 2019.
Tip: To see where users will find the button in each version of Outlook, see Submit suspected phishing emails with the Phish Alert Button in Outlook.
How to deploy and update the Phish Alert Button on Microsoft 365
1. Sign into the Microsoft 365 Admin Portal
2. Click Show all on the side panel on the left
3. Go to Settings > Integrated Apps
4. Click Upload Custom Apps if you are installing the Phish Alert Button for the first time. Otherwise, click your installed Phish Alert Button Add-In, and then Update Add-In
5. In the pop-up window under App type select Office Add-in
6. Select Upload manifest file (.xml) from device > Choose file and then select the Phish Alert Button manifest file from your computer
You can download the manifest (.xml) file from your Phish Alert Settings Page
7. Wait for the file to be uploaded and validated, and then click Next
8. Choose whether you want to deploy the Phish Alert Button to just yourself, the entire organisation, or specific sets of users or groups. Click Next to continue.
If you use the usecure Microsoft 365 Sync, your deployment audience should match your configuration to avoid users who aren't on the platform from using the Phish Alert Button.
NOTE: The next step applies only if you enabled Retrieve Message Data via the MS Graph API on Behalf of a User using SSO in your Phish Alert settings. If you did not, skip to step 10.
9. You will be taken to an Accept permissions requests screen. Click Accept Permissions to open a Microsoft consent pop-up. Select and log in to the admin account you wish to use, review the permissions, and click Accept once satisfied.
If you do not see the accept permissions screen, you will need to cancel the deployment, re-download your manifest from the Phish Alert Settings page and start the deployment again with the new XML file.
10. Click Next on the Accept permissions requests screen
11. Click Finish deployment to complete the process if you are installing the Phish Alert Button for the first time, or Accept and update if you are updating the add-in.
Add-in deployments can take up to 6 hours to complete, although this could be up to 24 hours depending on your organisation's size. We recommend leaving it overnight before checking an Outlook client to see if it's installed.
Desktop and mobile clients will need to be restarted to see any changes.
OWA will need to be reloaded also.
How to deploy the Phish Alert Button on Exchange 2013/2016/2019
1. Sign into the Exchange Admin Center
2. Go to Organization > Add-ins
3. Click the plus icon and select Add from file
4. Click Choose file on the Add from File pop up that appears, select the Phish Alert Button manifest file from your computer then click Next when the upload has completed.
You can download the manifest (.xml) file from your Phish Alert Settings Page
NOTE: You will receive an error referring to SSO if you enabled Retrieve Message Data via the MS Graph API on Behalf of a User using SSO in your Phish Alert settings. These features are only available when the add-in is installed via Microsoft 365. You will need disable them and redownload your manifest to continue with the Exchange installation.
5. You can then deploy the add-in to your users by selecting the Phish Alert Button row and clicking on the pencil icon.
If you don't see a Phish Alert Button row it means you set the Add-in Display Name in your Phish Alert Settings to something different.
6. On the Edit Add-in settings pop up, select Mandatory, always enabled. Users can't disable this add-in under Specify User Defaults and then click Save to complete the deployment.
How to enable the Phish Alert Button for Shared Mailboxes in Microsoft 365
Follow these steps to configure the Phish Alert Button for use with shared mailboxes in your organization:
In your usecure account, navigate to Settings > uPhish> Phish Alert Button, and then to the tab Outlook Add-in Configuration.
Scroll down to the option to enable shared mailboxes, and enable the toggle "Show the add-in on Shared Mailboxes".
Download the updated manifest XML file from your Phish Alert Settings Page.
Deploy or update the Phish Alert Button for Outlook using the new manifest file, following the instructions in the appropriate section above (Microsoft 365 or Exchange).
Automatic Application to New Shared Mailboxes
Once you have deployed the updated manifest XML file with shared mailbox settings enabled, the Phish Alert Button for Outlook will automatically function with all future shared mailboxes without requiring additional redeployment.
Troubleshooting Shared Mailbox Access
If you encounter issues with the Phish Alert Button for outlook in shared mailboxes:
Ensure you have implemented the latest version of the manifest file.
Double-check that the "Show the add-in on Shared Mailboxes" setting is enabled.
Verify that users accessing the shared mailbox have the appropriate permissions.