Exchange Online is tagging legitimate emails as spam — what to do

Microsoft says some legitimate email messages in Exchange Online have been marked as phish and quarantined, preventing them from appearing in users' inboxes. The company acknowledged the problem in a service alert, saying the issue began on February 5. Investigators traced the issue to a new URL rule that is incorrectly flagging certain legitimate URLs as malicious.

Those false positives cause messages from affected domains to be treated as phishing attempts and placed in quarantine. Microsoft has made progress fixing the error, and some previously quarantined messages may already be appearing in inboxes. Other messages will remain in quarantine until the rule is fully corrected.

If you use Exchange Online, check the Quarantine page for Microsoft Defender while signed in with your work or school account. If you find a legitimate message, select it and click Release to remove it from quarantine; otherwise you will need to wait for Microsoft to complete the correction.

exchange online, microsoft, phishing, quarantine, microsoft defender, url rule, false positives, quarantine page, release button, february 5