Skip to content

Installing the Sophos Outlook add-in

Install the Sophos Outlook add-in to make it easier for your users to report suspicious messages.

To install the add-in, do as follows:

Is my environment compatible with the add-in?

The add-in is available for the following environments:

  • Microsoft Outlook for Windows and Mac.
  • Microsoft Outlook on the web (formerly Outlook Web App).
  • Microsoft Outlook for iOS and Android.
  • Microsoft 365 (formerly Office 365) and Exchange.


  • The add-in doesn't support Exchange 2013 or non-Microsoft email services like Gmail or other POP/IMAP accounts.
  • The mobile device add-in only works on Microsoft 365 Exchange servers and isn't compatible with on-premises Exchange servers.


If you've installed the Sophos Outlook add-in, please ensure your users have the latest version.

To find out which version is deployed in your Microsoft environment and how to upgrade, see Upgrading the Outlook add-in.

Configure the add-in

Before deploying the add-in to users, you must set up one or more mailboxes where reports of suspicious messages are delivered.

To add a mailbox, do as follows:

  1. Go to My Products > Phish Threat > Settings > Report Message Add-in for Outlook.
  2. Click Add mailbox to add a new mailbox.

Download the XML manifest

When you've configured the mailboxes, you must download the XML manifest.

To download the manifest, do as follows:

  1. Go to My Products > Phish Threat > Settings > Report Message Add-in for Outlook.
  2. Click the Download XML Manifest link.
  3. Save this file in a location where you can access it during the deployment step.

Deploy the add-in

You use Microsoft's add-in deployment process for deploying the add-in. The steps in this stage link to appropriate instructions or advice provided by Microsoft for each step.


Check the latest information provided by Microsoft on deploying add-ins before proceeding. Use the instructions provided by Microsoft if there are any differences from the help we provide.

To deploy the add-in, do as follows:

  1. Test whether users can install the add-in. To do this, follow the instructions in Sideloading installation instructions.

    Sideloading is recommended for proof of concept and testing purposes only. It refers to the process of installing the add-in for a user.

  2. Check if Office 365 centralized deployment of add-ins works in your environment. See Determine if centralized deployment of add-ins works for your organization.

  3. When you're ready to begin centralized deployment of the add-in, follow the instructions in Deploy add-ins in the Microsoft 365 admin center.
  4. Optional: For customers in an on-premise environment without a connection to Microsoft 365, use the Exchange Admin Center to install the add-in for your organization. For more information, see Exchange admin center in Exchange Server.

If the add-in won't install on endpoint computers or it doesn't appear in the list of available add-ins, you must install the latest Microsoft Office updates.