Microsoft Defender Safe Links mistakenly blocks legitimate Google Search links
Microsoft is addressing incident MO1465962, in which Safe Links in Defender for Office 365 is flagging legitimate URLs from Google Search as malicious.
Safe Links for Google Search links is affected by incident MO1465962, which Microsoft is tracking in Defender for Office 365. The protection mechanism may block legitimate links from Google Search because it inaccurately classifies them as malicious.
Affected users may see a security warning when opening a link. Administrators may also see related alerts in the Microsoft Defender portal and Microsoft Sentinel. Microsoft said it is working on a fix for the incorrect classification.
What causes Safe Links to block Google Search links
Safe Links checks URLs when they are clicked and is designed to protect against phishing and malicious links. In this case, however, there is no confirmed exploitation of a vulnerability or system compromise. Microsoft attributes the incident to the inaccurate security classification of legitimate URLs, meaning false-positive detections.
The practical impact may occur with links in email, Teams, or other Microsoft 365 applications that use Safe Links scanning. Users may be prevented from accessing a search result even though the link itself is not malicious.
The scope is not yet public
Microsoft has not publicly disclosed the number of affected customers, regions, or the exact scope of the impact. It has also not been confirmed which Google Search URL variants are affected or when the fix will be deployed.
At the time of verification, no public primary Microsoft service notice for incident MO1465962 was available. The alert details were relayed by BleepingComputer. Therefore, there is also no confirmed temporary procedure that would safely restore access to all incorrectly blocked links.
What administrators can monitor
Microsoft Learn documents that Defender for Office 365 administrators can manage URL allow and block entries in the tenant’s allow and block list. The documentation also includes a procedure for reporting URLs that were incorrectly identified as malicious. However, Microsoft has not yet publicly confirmed a specific mitigation recommendation for incident MO1465962, including any possible exceptions or allowed URL list.
Security teams should monitor the notice about the fix and incident closure, as well as any official clarification of the affected tenants, regions, and URLs. False positives in email protection can disrupt normal communication and may also cause users or administrators to pay less attention to security warnings.
Sources
- BleepingComputer – Relays the content of Microsoft’s service alert, the MO1465962 identifier, the cause in the form of incorrect classification, and the ongoing remediation.
- Microsoft Learn – Documents that administrators can manage URL allow and block entries in Microsoft Defender for Office 365.
- Microsoft Learn – Documents the procedure for reporting URLs that were incorrectly identified as malicious.
Verified and updated: 02. 09. 2026 13:15
