{"id":86257,"date":"2026-02-11T06:18:29","date_gmt":"2026-02-11T09:18:29","guid":{"rendered":"https:\/\/ubirataonline.com.br\/exchange-online-flags-legitimate-emails-as-phishing\/"},"modified":"2026-02-11T06:18:32","modified_gmt":"2026-02-11T09:18:32","slug":"exchange-online-flags-legitimate-emails-as-phishing","status":"publish","type":"post","link":"https:\/\/ubirataonline.com.br\/en\/exchange-online-flags-legitimate-emails-as-phishing\/","title":{"rendered":"Exchange Online flags legitimate emails as phishing"},"content":{"rendered":"


\n<\/p>\n

\n

\n

Microsoft is investigating an ongoing Exchange Online issue that mistakenly flags legitimate emails as phishing and quarantines them.<\/p>\n

The incident began on February 5 and continues to affect Exchange Online customers, preventing them\u00a0from sending or receiving emails.<\/p>\n

“Some users’ legitimate email messages are being marked as phish and quarantined in Exchange Online,” Microsoft said in a\u00a0service alert<\/a>\u00a0when it acknowledged the bug on Thursday.<\/p>\n

\n \"Wiz\"<\/a>\n<\/div>\n

“We’ve determined that the URLs associated with these email messages are incorrectly marked as phish and quarantined in Exchange Online due to ever-evolving criteria aimed at identifying suspicious email messages, as spam and phishing techniques have become more sophisticated in avoiding detection.”<\/p>\n

Over the weekend, Microsoft confirmed that the issue is caused by a new URL rule that incorrectly flags some URLs as malicious and the emails as phishing attempts.<\/p>\n

“An updated URL rule intending to identify more sophisticated spam and phishing email messages is incorrectly quarantining legitimate email messages in Exchange Online, resulting in impact,” it added.<\/p>\n

While Microsoft has yet to disclose how many customers are affected or which regions are impacted by this ongoing issue, it has classified it\u00a0as an incident, which typically involves noticeable user impact.<\/p>\n

Until the issue is resolved, Microsoft is working to release quarantined emails and said that affected users may begin to see previously flagged messages in their inboxes.<\/p>\n

“We’re reviewing the release of quarantined messages for affected users and working on confirming legitimate URLs are unblocked,” it noted on Saturday. “Some users may see their previously quarantined messages successfully delivered and we’re working to confirm full remediation. We’ll provide an estimated time to resolve when one becomes available.”<\/p>\n

Microsoft has addressed similar issues over the last several years, resulting in emails being quarantined or incorrectly tagged as spam or malicious. For instance, in March, an Exchange Online bug caused anti-spam systems\u00a0to mistakenly quarantine some users’ emails<\/a>, and\u00a0another one\u00a0in May caused\u00a0a machine learning model to\u00a0incorrectly flag emails from Gmail accounts as spam<\/a>.<\/p>\n

More recently, in September, an anti-spam service bug mistakenly\u00a0blocked Exchange Online and Microsoft Teams users<\/a>from opening URLs and quarantined some of their emails.<\/p>\n

\n
\n
\n \"tines\"\/<\/a>\n <\/div>\n
\n

Modern IT infrastructure moves faster than manual workflows can handle.<\/p>\n

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.<\/p>\n