FEATURE: Reporting from Shared Mailbox


Reporting real phishing / spam emails from shared mailboxes or reporting in a delegate scenario is supported by Hoxhunt add-in. Delegate access or delegate scenario is when a user has given delegate permissions to another user to access their mailbox.

Hoxhunt training emails should not be sent to shared mailboxes as the training is supported for personal mailboxes.

However, if you deploy the Hoxhunt button to shared mailboxes and add them in your account, your employees can report real phishing / spam emails sent to the shared mailboxes.

IMPORTANT: Outlook add-ins cannot be activated in group mailboxes, archived mailboxes or in public folders. Add-ins are only supported by Microsoft in shared mailboxes via delegate access. 


NOTE: If you have deployed Hoxhunt Report COM add-in, reporting from shared mailboxes is already possible. This article only refers to Hoxhunt Report add-in deployed via manifest.xml.


Note for Web Outlook users: You must access the shared mailbox directly from your inbox's left navigation pane. Using Open another mailbox option in Web Outlook is not supported. This is limited by how Office.js Roaming Settings work.

Note for desktop Outlook users: Mailbox needs to be added to your Outlook profile as additional mailbox, not as additional account. 


Technical requirements

Updated Hoxhunt add-in (manifest.xml version
A small change is needed in the manifest.xml to make the add-in visible and accessible in shared folders and mailboxes with delegate access. In order to enable the feature to your employees you need to either update the add-in or remove and re-deploy it, depending on the deployment method you used.

How can we check the version number of currently installed Hoxhunt Outlook add-in?

Requirement set 1.8
Access for add-ins in shared mailboxes is part of Outlook JS API Requirement set 1.8, which is the most recent version at the time of writing.

NOTE: Requirement set 1.8 is not yet available on all client/server configurations. Additionally, accessing shared mailboxes is not supported with EWS, but only using the REST API. In some cases the add-in is still visible in shared mailboxes in unsupported clients but it will not work properly. Please find below supported servers and clients based on Microsoft documentation.

Exchange server

Supported versions

Exchange Online (O365/M365)

Latest build

Exchange Server (on-premise)

Not supported

NOTE: The feature only works with cloud mailboxes. Make sure your shared mailbox isn't located on-premise.

Outlook client 

Supported versions 

Outlook on Windows

  • Microsoft 365 subscription
  • Outlook 2019 one-time purchase (retail)
  • version 1910 (*build: 16.0.12130.20272+)

OWA (Chrome, Safari, IE11, Firefox)

Modern Outlook UI
connected to Exchange Online:
Microsoft 365 subscription

Outlook for Mac

Not supported*

Outlook Mobile

Not supported

*Some versions of the latest Outlook on Mac support Requirement set 1.8, but not Delegate access, thus the feature is not available on Outlook for Mac.


MS Dev article about supported scenarios and restrictions: https://docs.microsoft.com/en-us/office/dev/add-ins/outlook/delegate-access?tabs=windows
Discussion on Shared Mailbox support: https://officespdev.uservoice.com/forums/224641-feature-requests-and-feedback/suggestions/11634318-support-for-shared-mailboxes
About Outlook JS API Requirement sets: https://docs.microsoft.com/en-us/office/dev/add-ins/reference/requirement-sets/outlook-api-requirement-sets
About Delegate access: https://docs.microsoft.com/en-us/office/dev/add-ins/outlook/delegate-access


How to enable the feature for your employees

A) If Hoxhunt was deployed via Centralized Deployment

If you deployed Hoxhunt add-in via Centralized Deployment, you can use Update add-in command located in Settings > Add-ins > Hoxhunt Report > Update add-in.


Enter the manifest.xml URL: https://officejs.hoxhunt.com/api/v1/manifest/default/manifest.xml

IMPORTANT: If adding from URL fails, please download the manifest.xml to Desktop and use Add from file... option instead. You may still receive an error but the update works this time.

NOTE: It may take several hours for desktop Outlook clients to detect the updated add-in. You can verify update process worked more quickly via Web Outlook.


B) If Hoxhunt was deployed via Exchange Admin Center

If you deployed Hoxhunt add-in via Exchange Admin Center (organization > apps/add-ins) or via New Exchange Admin Center (Organization > Add-ins), there is no Update option available. You first need to remove Hoxhunt add-in and then re-deploy it. Please note this will temporarily remove the add-in from end users and create some service disruption.


C) My organization deployed a customised Hoxhunt button

If your organization has deployed a customised Hoxhunt add-in (e.g. custom logo), replace the URL with your custom manifest URL, and then proceed either option A) or B) depending on your original deployment method.


Cannot forward emails to Microsoft from shared mailboxes 

Hoxhunt offers an integration where phishing, spam and not spam reports can be added as user submissions to Microsoft. More information is available here FEATURE: Upload reported threats to Microsoft (Defender Integration)

However, it is not possible to forward emails reported from a shared mailbox to Microsoft as a user submission. This is a limitation within Microsofts own reporting add-in, which is why the same limitation applies to the Hoxhunt add-in.

You can still redirect spam and phishing reports from shared mailboxes to a specified email address or upload them to Hoxhunt for analysis. 


Frequently Asked Questions

Is reporting supported for group mailboxes?
No, because Microsoft Outlook doesn’t support add-ins for group mailboxes.


Is reporting supported for delegate access mailboxes? (User A has given permissions to User B)?
Yes, in the same way as for shared mailboxes, as long as they have high enough permissions.

Note for Web Outlook users: You must access the shared mailbox directly from your inbox's left navigation pane. Using Open another mailbox option in Web Outlook is not supported. This is limited by how Office.js Roaming Settings work.

Note for desktop Outlook users: Mailbox needs to be added to your Outlook profile as additional mailbox, not as additional account. 


Can users with Hoxhunt add-in deployed report emails from shared mailboxes that don't have Hoxhunt add-in deployed?

Yes. Hoxhunt add-in works with user's permissions and does not required add-in to be deployed to the shared mailbox itself. The button will activate and run as the reporting user. 


How do I know which Outlook client version I have?
Please check this MS article.


Some of our Outlook clients don't support the new feature. Can we still update to new version?
Yes. For Outlook clients that don't meet the requirements, Hoxhunt add-in works as before but without the ability to report from shared mailboxes.

Supported version mentions "Modern Outlook UI in OWA" - how can I tell the difference?



We have enabled a Hoxhunt feature that removes the reported email from Inbox once the email has been reported. However, this is not working when reporting emails from a shared mailbox. Why?

The removal feature is not supported when reporting emails from a shared mailbox and you have Defender integration with Hoxhunt. Microsoft doesn't support this scenario, unfortunately.

Was this article helpful?

6 out of 8 found this helpful

Have more questions? Submit a request