Login to your Microsoft 365 Defender portal and navigate Settings > Email & collaboration.

Now, navigate to Mail flow > Rules > click + icon (add new rule). You can copy the existing rules for future reference.

From the + icon (add new rule) drop-down, select Create new rule…

Enter Forward Junk Emails to PhishArm in the name field.

From the Apply this rule if… drop-down, select The recipient address includes…

In the specified words or phrases pop-up, paste the Internal Mailbox email.

Click on the + icon next to the condition to add another rule.

In the And The message headers.... drop-down, select includes any of these words.

Enter 'X-Forefront-Antispam-Report' and 'SFV:SPM' in the corresponding fields as per the above screenshot.

As we finish the condition, we have to define the action.
From the Do the following… drop-down, select Add receipients and from the options, select to the To box.

Click on Select On, and a window with the list of all the contacts will appear. Search for the right-hand reporting email, i.e., [email protected], and select it. Then click on the save button to save the recipient.

Now Click on the Next button and set the following values to

Click on Next and then the Finish button. The rule will appear in the list.

Now, we need to edit this rule further. Click on the rule, and it will open the slider. Enable this rule by clicking the toggle and then clicking on the rule settings. Change the Priority to 0 and click on the save button.

After that, the rule will appear enabled at the top of the list.

The configuration has been successfully set up :)