update (41035) - refactored code based on updated spec

Author: sandeepjha000

src/powershell/public/Get-ZtGraphScope.ps1

@@ -51,6 +51,7 @@
         'SecurityIdentitiesSensors.Read.All'
         'SecurityIncident.Read.All'
         'ThreatHunting.Read.All'
+        'ThreatSubmission.Read.All'
         'UserAuthenticationMethod.Read.All'
     )
 

src/powershell/tests/Test-Assessment.41035.md

@@ -1,4 +1,4 @@
-Account-takeover threat actors regularly succeed against email filters — credential phishing, business-email-compromise lures, and AI-generated spear phishing reach inboxes after every automated control has decided the message is clean. The last line of detection in those cases is the user, but only if they have a one-click way to report the message and only if those reports actually reach somewhere a human responder can act on them. When user reporting is turned off, points to a mailbox no one watches, or skips Microsoft entirely, a successful phish reaches credential capture, the threat actor moves on to mailbox persistence and lateral campaigns against colleagues, and the SOC never learns the original message slipped through — so it cannot pull the same campaign out of other mailboxes before the attack progresses. Routing reports to Microsoft also feeds the global anti-phishing model so every customer benefits from every reported message. The recommended baseline turns on the built-in Outlook Report button, routes user-reported messages to both Microsoft (for re-evaluation and model training) and to a monitored SOC mailbox (so analysts can hunt the campaign), and exposes the submission queue programmatically through the Microsoft Graph email threat submission API so SOC tooling can ingest them automatically.
+Account-takeover threat actors regularly succeed against email filters — credential phishing, business-email-compromise lures, and AI-generated spear phishing reach inboxes after every automated control has decided the message is clean. The last line of detection in those cases is the user, but only if they have a one-click way to report the message and only if those reports actually reach somewhere a human responder can act on them. When user reporting is turned off, points to a mailbox no one watches, or skips Microsoft entirely, a successful phish reaches credential capture, the threat actor moves on to mailbox persistence and lateral campaigns against colleagues, and the SOC never learns the original message slipped through — so it cannot pull the same campaign out of other mailboxes before the attack progresses. Routing reports to Microsoft also feeds the global anti-phishing model so every customer benefits from every reported message. The recommended baseline turns on the built-in Outlook Report button, routes user-reported messages to both Microsoft (for re-evaluation and model training) and to a monitored SOC mailbox (so analysts can hunt the campaign), and exposes the submission queue programmatically through the Microsoft Graph email threat submission API so SOC tooling can ingest them automatically. A check that fails means the customer has a Report button that goes nowhere actionable — a known false-sense-of-security pattern.
 
 **Remediation action**