Microsoft Defender Flags Legitimate Google Search Links as Malicious

Microsoft Defender for Office 365 Safe Links is a feature that rewrites and re-checks URLs at the moment a user clicks them, guarding against phishing and malware links in email, Teams, and Office apps. On 2026-09-02, Microsoft confirmed at 10:30 AM UTC that this same feature is now misfiring against a source it should never flag: Google's own search results.

Microsoft tracks the problem under incident MO1465962 and says users hitting the bug see a page reading "Opening this website might not be safe" instead of their intended Google search result. According to a service alert reviewed by BleepingComputer, Microsoft attributes the block to "an inaccurate security classification" applied to legitimate Google search URLs, not to any change on Google's side.

Microsoft explicitly warned that pasting the blocked Google search URL straight into a browser still triggers the warning and does not bypass the issue.

That distinction matters for helpdesk teams triaging tickets, since the usual first-line advice, copy the link, open it manually, will not resolve user complaints while the underlying classification remains wrong.

Any Microsoft 365 organization licensed for Defender for Office 365 with Safe Links URL protection enforced can hit the block when a user clicks a Google search link inside email, Teams, or Office apps. Microsoft has not disclosed which regions or how many customers are affected, and BleepingComputer reports the company classified the incident as an advisory, a designation Microsoft typically reserves for service issues of limited scope or impact.

• Microsoft 365 tenants with a Defender for Office 365 license enforcing Safe Links
• IT administrators monitoring the Defender portal and Microsoft Sentinel for related alerts
• End users clicking Google search result links from Outlook, Teams, or Office apps

Beyond blocked links, Microsoft warned IT administrators that the misclassification generates noise inside their security tooling: related alerts and incidents can appear in both the Microsoft Defender portal and Microsoft Sentinel, the company's SIEM platform. Security teams triaging these alerts need to recognize them as false positives tied to MO1465962 rather than genuine detections requiring investigation, to avoid wasting analyst time chasing a known service issue.

This is not Microsoft's first false-positive incident affecting Defender for Office 365 or Exchange Online. BleepingComputer notes that a machine-learning model previously misflagged Gmail-originated emails as spam, and a separate anti-spam bug quarantined legitimate messages for other users. More recently, an Exchange Online issue in February prevented some users from sending or receiving mail and flagged legitimate messages as phishing, quarantining them.

Microsoft is separately working through a broader Microsoft 365 outage causing authentication issues, service delays, and connection problems, according to BleepingComputer, though that incident is distinct from the Safe Links classification bug.

Microsoft says it is "working to correct the misclassification to remediate impact," but has not published a fix timeline or confirmed which Safe Links policy configurations are involved. Admins should watch the Microsoft 365 admin center for updates tied to MO1465962 and treat Google search link blocks and related Sentinel or Defender portal alerts as expected noise until Microsoft posts resolution.

Safe Links misclassification blocks legitimate Google search URLs across Microsoft 365 tenants that enforce Defender for Office 365 URL protection, disrupting routine browsing rather than a narrow phishing scenario.

Security: The false positive generates noise in the form of related alerts in the Microsoft Defender portal and Microsoft Sentinel, which can distract analysts from genuine phishing detections during the incident window.

Microsoft confirmed that a misclassification in Defender for Office 365 Safe Links is blocking legitimate Google search links under incident MO1465962.