Microsoft Defender flags Google search links as malicious

Free Instant SEO Audit

By NewSunSEO September 27, 2026

Readers using Microsoft 365 get clearer access to Google search results after Microsoft resolved a Defender for Office 365 Safe Links false positive that was flagging legitimate Google search URLs as malicious. The fault originated in an inaccurate security classification inside the Safe Links protection layer, which had been rewriting and time-of-click checking links inside email, Teams and Office 365 apps. With the fix deployed, IT teams can expect the false alerts in Microsoft Sentinel and the Defender portal to clear as the mitigation rolls through the service.

What happened inside Defender for Office 365 Safe Links

Safe Links is the time-of-click URL scanning feature in Microsoft Defender for Office 365. It rewrites inbound hyperlinks during mail processing, then re-checks the destination when a user clicks the link from email, Teams or other Office 365 apps. When the rewritten link is opened, Safe Links consults its classification and either allows the click, blocks it with a warning page, or detonates the URL in a sandbox.

During the incident, tracked internally as MO1465962 and first acknowledged at 10:30 AM UTC, that classification step went wrong for Google search URLs. The feature began labeling ordinary Google search links as malicious and serving users a warning that read, “Opening this website might not be safe.”

Microsoft also told administrators that the Defender portal and Microsoft Sentinel, the security information and event management (SIEM) tool, would surface related alerts and incidents because the misclassification was feeding both detection layers.

Why copying the link did not bypass the warning

Safe Links protection runs at the click point, not the inbox point. The warning page is generated by Safe Links when a user selects a rewritten URL from a supported app. Copying the link and pasting it into a browser directly bypasses Safe Links entirely, but in this case the warning still appeared.

The reason is that the fault sat in the classification data Safe Links uses. The URL had already been rewritten on the mail server, and the rewritten pointer still resolved through Safe Links on click. Until Microsoft corrected the classification, the same misidentification happened whether users clicked through email or copied the link across.

Which Microsoft 365 tenants were affected

Microsoft did not name affected regions or publish a count of impacted customers. The company classified the event as an advisory rather than an incident, a category Microsoft typically reserves for service issues with limited scope or impact.

Admins who saw Defender or Sentinel alerts against Google search URLs during the window were therefore seeing the same classification fault, and the alerts cleared once Microsoft corrected the classification.

How Microsoft fixed the misclassification

A service update the day after the initial acknowledgment said the issue had been successfully resolved. Microsoft attributed the cause to the same inaccurate security classification that produced the false positives and said the remediation was being applied across the service infrastructure.

Microsoft also warned that some users could still see the old behavior for a limited time after the fix, because Safe Links classifications propagate gradually rather than flipping everywhere at once.

A pattern of Microsoft 365 false positive incidents

A new false positive event is affecting Microsoft 365 messaging and security products.

In 2025, an Exchange Online machine learning model incorrectly flagged emails from Gmail accounts as spam.
A separate Exchange Online anti-spam bug quarantined legitimate email from certain senders.
In February 2026, an Exchange Online issue blocked users from sending or receiving email and routed legitimate messages into the phishing quarantine.

The Defender incident is also running alongside a separate, large scale Microsoft 365 outage that has caused authentication failures, service delays and connection problems across multiple workloads.

What admins should do while the fix rolls out

For IT teams running Defender for Office 365, the practical steps during this kind of event are limited because the classification sits inside the service.

Avoid manually allow-listing the blocked Google search URLs across individual mailboxes, because the underlying classification will revert once Microsoft pushes the corrected data.
Watch Microsoft Sentinel and the Defender portal for residual alerts tied to Google search URLs and close them as duplicates once the mitigation is confirmed, rather than treating them as fresh detections.
Document the false positive window so help desk teams can stop opening phishing tickets for routine Google search clicks.

FAQ

What was wrong with Microsoft Defender flagging Google search links?

An inaccurate security classification in Defender for Office 365 Safe Links was causing legitimate Google search URLs to be identified as malicious, which made Safe Links block the links and display a “website might not be safe” warning.

Did Microsoft fix the Defender Safe Links false positive?

Yes. Microsoft said the issue had been successfully resolved and was caused by the inaccurate security classification, while noting that some users could keep seeing the old behavior for a limited time as the mitigation propagated through the service.

Why did copying a Google search link and pasting it into a browser still trigger the Defender warning?

Safe Links rewrites links during mail flow and re-checks them at click time, so the classification fault affected both the rewritten email links and the links users pasted directly into a browser until Microsoft corrected the classification.

Related coverage

SEOScanPRO

SEOScanPRO has the AI visibility report, which runs a full technical audit of a site and shows the measured result behind every check. Open the AI visibility report.