2

I'm viewing a message trace from https://admin.exchange.microsoft.com/#/messagetrace

If I expand "More Information" on the selected email, I see "Message id". When I go to https://security.microsoft.com/reportsubmission and try to submit it, it asks for a "Network Message ID". I tried entering the "Message id" from above, but it says it's invalid. I can't find "Network Message ID" (or any other ID) anywhere in the trace. What am I missing?

How do I submit a message to Microsoft?

THE JOATMON
  • 266
  • 8
  • 29

2 Answers2

0

Network Message ID: This is a GUID value that's available in the X-MS-Exchange-Organization-Network-Message-Id header in the message, or in the X-MS-Office365-Filtering-Correlation-Id header in quarantined messages. For more details: Submit a questionable email to Microsoft

Here are some steps for your reference:

1.open the email and click message option, you will see internet headers: enter image description here

2.Then you run EXRCA to run Message Header Analyzer and find the X-MS-Exchange-Organization-Network-Message-Id: enter image description here

Joy Zhang
  • 1,002
  • 1
  • 4
  • 5
  • hmm, I'm quite sure I used to be able to submit messages for analysis from an admin portal. Having to access the client is very inconvenient for me and the user. – THE JOATMON Feb 24 '21 at 20:27
  • I have done some test, i cannot find the network message id in message trace results, but i have found the -MessageTraceId is the Exchange Network Message ID. For more details: https://docs.microsoft.com/en-us/powershell/module/exchange/get-messagetracedetail?view=exchange-ps – Joy Zhang Feb 25 '21 at 08:38
-1

Yes same issue on this side, if I expand "More Information" on the selected email, I see "Message id". When I go to reportsubmission and try to submit it, it asks for a "Network Message ID". I tried entering the "Message id" from above, but it says it's invalid. I can't find "Network Message ID" (or any other ID) anywhere in the trace. I want to know how to find the correct network message ID for submission without asking the client for eml or msg files.

Aran
  • 7
  • 1
  • 1
    Ok found the solution finally. You need to go to: https://protection.office.com/threatexplorer Search for scam emails directly from here and submit them from there itself without any message network ID. – Aran Feb 26 '21 at 04:46
  • That page seems to only list phishing/malware that was detected. I cannot find the message in question there. – THE JOATMON Feb 26 '21 at 19:55
  • Glad you have found the solution, you could mark your reply as best answer if some people encounter the same issue they could find the solution quickly:) – Joy Zhang Mar 01 '21 at 06:44