Can reporting a phishing email in Outlook look like a click to administrators?

Reporting a message can create a user submission and, depending on the organization's Microsoft 365 settings, an alert for administrators. That alert by itself is not proof that you clicked a link or opened an attachment.

Ask the security team to check the event action and the user-reported message details in Defender, rather than relying on the alert alone. They should be able to distinguish what the alert says from what it actually establishes.

There can also be a false click recorded during analysis. A reporting or security service may load a link, and a phishing simulation platform can count that activity as a user click. That's a possible explanation here, not something the alert alone confirms.

The admins would need to compare the timing and details of the reported message with the click event and the simulation platform's records.

Check which reporting button your security team wants people to use. Some organizations have a separate phishing add-in that sends messages to their own security team, while Outlook's built-in reporting can follow a different configured route. Ask them to clarify the process before changing what you do.

The admin configuration matters. Reporting can be set up to send messages for analysis or to the organization's security team, and alerts can be configured differently too. There isn't one universal admin view that proves what happened in every setup.

I'd ask the team to review both the reporting policy and any third-party phishing tools. If the current setup is counting analysis activity as employee clicks, they can investigate that rather than treating every alert as a failed test.