Microsoft Defender Blocks Legitimate Google Links as Malicious
Photo: BleepingComputer
Quick answer
Microsoft is investigating a Defender for Office 365 glitch that incorrectly flags legitimate Google search links as malicious, triggering false security alerts.
Microsoft has confirmed an issue in its Defender for Office 365 enterprise email security solution, where legitimate links to Google search results are being incorrectly blocked. Users encounter security warnings when attempting to access these links. The incident, tracked under ID MO1465962, was detected at 10:30 UTC.
According to Microsoft, the root cause of the glitch lies in the incorrect threat classification by the Safe Links system, which verifies URLs in emails, Teams messages, and Office 365 apps. As a result, legitimate Google search links are mistakenly flagged as malicious. Administrators may observe false alerts in the Defender and Microsoft Sentinel dashboards.
Microsoft is actively working on a fix, though no workarounds are currently available. Similar false-positive incidents have occurred before, including in February 2024, when Exchange Online blocked legitimate emails as phishing attempts. Microsoft has classified this issue as advisory, indicating limited scope or impact.
Common questions
- Why is Microsoft Defender blocking Google links?
- The issue stems from incorrect threat classification in Defender for Office 365. Legitimate Google search links are mistakenly flagged as malicious due to a security system failure.
- How can I bypass the Google link block in Defender?
- Currently, copying and pasting links directly into a browser does not resolve the issue. Microsoft is actively working on fixing the incorrect classification.
- Which systems are affected by this glitch?
- The glitch impacts users of Defender for Office 365 and administrators receiving false alerts in Microsoft Defender and Microsoft Sentinel.
Dzen feed: /feed/dzen.xml · RSS: /feed.xml