FWIW, I did exactly that a few times where I was 90% certain the e-mail is legit, but it still looked like a phishing attempt. The IT department needs to learn to do better, this is inexcusable, especially in a corporation with otherwise restrictive policies that waste ridiculous amounts of money and effort (think: Windows Defender real-time "protection" on developer machines, with no way to exclude your repos).

I wanted to, but I could not find it. It turn out I could not see the "report phishing" button because of an Outlook glitch. Thanks Microsoft.

Forward the email to your security org?

This. We have a dedicated phish/scam/it-sec channel in Slack for this (in addition to an embedded “report this email” plug-in in Outlook).

I did end up forwarding the email to another IT service address (one that I knew was legit). They thanked me for the feedback and said they would improve the message.

It’s a good idea.

I am usually a bit pessimistic about it though. If their SOP doesn’t account for “looks like phishing but is from internal sender” then chances are that nobody connects the dots and informs that sender.

The intelligence of a small and motivated IT team seems difficult to scale.

This is even worse in companies that have security offices actively sending out phishing emails worded as internal emails from your company that shame you if you click any of the links in them.

email is well and truly dead.

That reminds me that we had a "chief architect" who sent out his fairwell email with a link to his linked-in page in the footer, but the link actually went to a certain music video on youtube.

I suppose, if you want to train people to not click on links, that's a fun way to do it.