Microsoft Defender Mistakenly Blocks Legitimate Google Search Links

Microsoft is investigating an issue that causes Defender for Office 365 to incorrectly identify legitimate Google search URLs as malicious and block access to them.

The incident, tracked as MO1465962, was first acknowledged at 10:30 AM UTC. Affected users see “Opening this website might not be safe” warnings when they try to open blocked hyperlinks. Copying the links and pasting them directly into a browser does not bypass the warning.

Microsoft said the problem is caused by an inaccurate security classification. It warned IT administrators that they may also see related alerts and incidents in the Microsoft Defender portal and Microsoft Sentinel.

The issue affects Microsoft Defender for Office 365 Safe Links, which protects organizations by rewriting links in inbound email during mail flow and checking URLs when users click them in email messages, Teams, and Office 365 apps. The feature is available to organizations with a Defender for Office 365 license.

Microsoft has not disclosed which regions are affected or how many customers are impacted. The company classified the incident as an advisory and said it is working to correct the misclassification.