- Write a professional email with a clear subject line and structure
- Recognize the signs of a phishing email and report it in Outlook
- Protect your account with two-factor authentication and good password habits
In the morning Aysel receives two emails. The first is from a client asking when she will send the report. The second is from “Microsoft 365”: “Your password expires today! Click here now to keep your account.” The first needs a professional reply; the second needs to be recognized and made harmless. This lesson teaches both skills.
The structure of a professional email
A good work email can be read in 30 seconds, and the reader knows right away what to do. The main point goes in the first sentence; the request and deadline get a line of their own. You can use the template below for any work email.
| Part | Example |
|---|---|
| Subject | March delivery report — approval by 15 April |
| Greeting | Dear Mr Guliyev, |
| Purpose (1 sentence) | I'm sending you the delivery report for March. |
| Details | A short list: 42 deliveries, 2 delays, reasons on page 3. |
| Request and deadline | Please approve the report or send your comments by 15 April. |
| Closing and signature | Kind regards, Aysel Huseynova Project Manager, Khazar Tech |
- Make the subject specific: not “Question” or “Important!”, but “Exhibition budget: approve 3 changes by 20 May”.
- One email, one topic. Start a new message for a new topic so it can be found in search.
- DON'T WRITE IN CAPITALS — it reads as shouting. Use the high-importance mark rarely, too.
- Check before sending: recipients, attachment, spelling of names. When you're upset, leave the message in Drafts and reread it later.
How to recognize phishing
A fake message that pretends to come from a well-known company, a bank or a colleague. Its goal is to steal passwords or card details, or to install malware on your computer.
- The real sender address doesn't match the name: the name says “Microsoft 365”, but the address is
security@micros0ft-support.com(a zero instead of an o). - Urgency and threats: “within 24 hours”, “your account will be closed”, “final warning”.
- A request for a password, code or payment. Real companies and your IT department never ask for your password by email.
- The link text and its real address differ. The text says
account.microsoft.com, but hovering over it reveals a completely different address. - An unexpected attachment: an “invoice.zip”, an
.htmlfile or an Office document that asks you to enable macros.
From: Microsoft 365 <security@micros0ft-support.com>. Text: “Dear user! Your password expires today. Click here within 2 hours to keep your account.” How many warning signs are there?
Show solutionHide solution
micros0ft has a zero instead of the letter o, and the domain doesn't belong to Microsoft.2. A generic greeting: “Dear user” instead of your name.
3. Urgency: “within 2 hours”.
4. A demand to click a password-related link.
Result: 4 signs — this is phishing. Don't click; report it and delete it.
What to do: report and protect
- 1Report the phishing
Select the message and choose
Home › Report › Report phishing. The message is sent to Microsoft (and, on a work account, to your organization's security team) and removed from your mailbox. For ordinary spam, chooseReport junk. - 2Verify through another channel
If the “director” asks for an urgent payment, don't reply to the email — call them on a number you know or message them in Teams.
- 3If you clicked, act fast
Change your password right away on the official site and tell your IT department. The sooner you tell them, the less damage — there is nothing to be ashamed of.
Signing in requires a second proof besides the password: a code sent to your phone or an approval in the Microsoft Authenticator app. Even if your password is stolen, a thief can't get in without your phone.
Key points
- A professional email: a specific subject, greeting, purpose in one sentence, short details, a request with a deadline, a signature.
- Phishing signs: a fake address, urgency, a request for a password or money, a mismatched link, an unexpected attachment.
- Before clicking a link, hover over it and look at the real address.
- Report a suspicious message with
Home › Report › Report phishing; if you clicked, change your password and tell IT. - 2FA protects your account even if your password is stolen; never share your password or codes.
Check yourself
10 questions. Every correct answer earns XP.