Steps
For Outlook users:
The primary way to submit reports of Spam and Phishing messages is by using the Report Message plug-in. This tool is available in Outlook via the ribbon, under the Protection section:
For Outlook on the web users:
The primary way to submit Spam and Phishing email messages is by using the Report Message add-in. For more information, see Use the Report Message add-in.
Or:
Create a new, blank email.
Address the email to the Microsoft team that reviews messages as follows:
For junk messages: address your email to junk@office365.microsoft.com.
For phishing scam messages: address your email to phish@office365.microsoft.com.
Copy and paste the junk or phishing scam message into that email (as an attachment).
Reference Articles:
https://technet.microsoft.com/en-us/library/jj200769(v=exchg.150).aspx
https://docs.microsoft.com/en-us/office365/securitycompliance/submit-spam-non-spam-and-phishing-scam-messages-to-microsoft-for-analysis
https://docs.microsoft.com/en-us/office365/SecurityCompliance/report-junk-email-and-phishing-scams-in-outlook-on-the-web-eop