Microsoft Defender flags legitimate Google search links as malicious

Microsoft Defender for Office 365 Safe Links feature incorrectly flags legitimate Google search URLs as malicious due to an inaccurate security classification. This results in blocking access to these URLs and generating alerts for administrators in Defender and Sentinel portals. The issue was acknowledged by Microsoft under incident MO1465962 and has been resolved as of September 3, 2026, with mitigation propagation ongoing. The false positive is similar to past incidents where legitimate content was mistakenly blocked by Defender or Exchange Online anti-spam systems.

Users of Microsoft Defender for Office 365 experienced blocked access to legitimate Google search links, accompanied by security warnings. Administrators received alerts in Defender and Microsoft Sentinel related to these false positives. The issue caused inconvenience and potential disruption in accessing legitimate web resources but did not indicate a compromise or exploitation. Microsoft classified the incident as limited in scope and impact.

Microsoft has resolved the inaccurate security classification causing the false positives. No further action is required by users or administrators beyond monitoring for residual effects as the fix propagates through the service infrastructure. Administrators should review alerts in Defender and Sentinel but no specific remediation steps are necessary.