Microsoft Defender for Office 365 Blocks Legitimate Google Search Links
Summary
Microsoft is investigating MO1465962 after Safe Links incorrectly blocked legitimate Google search links, showing unsafe-site warnings and triggering alerts in Sentinel and Defender. The affected scope is undisclosed; a fix is underway.
Key points
- Microsoft is investigating incident MO1465962, in which Defender for Office 365 Safe Links incorrectly classifies legitimate Google search URLs as malicious.
- Affected users see an “Opening this website might not be safe” warning when opening blocked links.
- Copying and pasting the links into a browser does not bypass the block.
- Administrators may also receive related alerts and incidents in Microsoft Sentinel and the Defender portal.
- Microsoft attributes the issue to an inaccurate security classification and says it is working to correct it; affected regions and customer numbers have not been disclosed.
Article Details
- Event Type
- False-positive security classification in Microsoft Defender for Office 365 Safe Links
- Impact
- Legitimate Google search links are incorrectly identified as malicious and blocked, showing users unsafe-website warnings. Administrators may also receive related alerts and incidents in Microsoft Sentinel and the Defender portal. Microsoft is investigating and working to correct the misclassification; the affected regions and number of customers have not been disclosed.
Vendors
Products
Microsoft Defender for Office 365Microsoft is investigating a Defender for Office 365 issue that is incorrectly flagging legitimate Google search links as malicious and showing users unsafe website warnings.Microsoft Defender Safe LinksDefender for Office 365 Safe Links is blocking legitimate Google search URLs.Microsoft SentinelThe misclassification is also generating alerts in Microsoft Sentinel and the Defender portal while Microsoft works on a fix.