Microsoft guides aren’t helping solve this issue

This message is due to a Microsoft O365 default alert policy “Form blocked due to potential phishing attempt” and all guides show that you should be able to review and unblock from the Security Admin Centre.

However, the buttons required are not present to be able to follow these guides.

How to manually review the form until the guides are updated or the buttons reappear in the Admin Centre.

1. Open the Microsoft Defender Admin Site, https://security.microsoft.com/
2. Navigate to Incidents & alerts -> Email & collaboration alerts
3. Find the alert labelled “Form blocked due to potential phishing attempt” and click to view the alert.
4. Click on View activity list and copy the text under the Item Column, make sure that this is not the user’s email address as the information is displayed incorrectly on the portal! This is the forms ID.
5. Then open the form using the ID from step 4 via https://forms.office.com/Pages/AdminPhishingReviewPage.aspx?id=<FormID>
6. At the top of the page, once you have reviewed the form, you can now select unblock.