Microsoft Exchange Online Erroneously Flags Legitimate Emails as Phishing

In a major glitch hitting Microsoft Exchange Online, legitimate business emails are being wrongly tagged as phishing attempts.

This service degradation, tracked as incident EX1227432, started on February 5, 2026, and has trapped valid messages in quarantine, blocking them from reaching inboxes.

The problem stems from a new anti-spam rule designed to spot malicious URLs in emails. Microsoft’s goal was to block advanced phishing attacks, where hackers hide dangerous links in messages.

But the rule went too far; it’s now flagging safe, everyday URLs as threats. This creates “false positives,” where harmless emails get quarantined automatically.

Affected users see both inbound and outbound emails stuck. Critical business communications, like invoices or client updates containing links to trusted sites (e.g., Dropbox shares), fail to deliver.

Reports from admins worldwide show productivity grinding to a halt as teams scramble to release trapped messages.

Microsoft hasn’t shared exact impact numbers, but the issue hits organizations using Exchange Online in Microsoft 365.

It targets specific URL patterns that mimic phishing tactics, even if they’re benign. For example, a legitimate link might trigger the filter if it matches heuristics for obfuscated or shortened URLs used by attackers.

Technical Root Cause: Overly Aggressive Spam Filter

At its core, Exchange Online’s anti-spam system uses machine learning models trained on vast datasets of phishing samples.

The recent update aimed to catch “zero-day” threats and novel attacks without known signatures. However, the model overgeneralized, misclassifying legitimate domains.

Quarantined emails land in the Microsoft 365 Defender portal under “High Confidence Phishing.” Admins can review them there, but bulk releases are manual and time-consuming.

Some users report partial fixes: Microsoft is whitelisting affected URLs, allowing previously blocked emails to flow again.

The company urges checking the Microsoft 365 Admin Center for EX1227432 updates. As of February 10, 2026, resolution is ongoing, with no firm ETA. IT teams note intermittent improvements, but full recovery lags.

This incident underscores AI security’s risks: stronger defenses can backfire without fine-tuning. Here’s how to respond:

• Monitor Quarantine Daily: Log into the Microsoft 365 Defender portal. Search for quarantined items by sender or subject, then release legit ones with one click.
• Submit False Positives: Use the “Submit for Analysis” tool in quarantine. This feeds data back to Microsoft, retraining filters faster.
• Check Mail Flow Rules: Review custom rules in the Exchange admin center to avoid conflicts, but skip broad bypasses high-confidence phishing overrides them.
• Temporary Workarounds: Route critical emails via approved gateways or use transport rules for known safe domains, testing first.

Microsoft promises filter tweaks to curb repeats. Meanwhile, this serves as a wake-up call: even top-tier platforms like Exchange need proactive monitoring. Stay vigilant, review quarantine weekly to dodge future hiccups.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.