Microsoft Exchange Online Flags Customers Legitimate Email as Phishing

Microsoft Exchange Online is experiencing an ongoing incident (EX1227432) where a newly introduced URL rule is falsely identifying legitimate emails as phishing, resulting in widespread quarantines and delivery disruptions since February 5, 2026. Microsoft is actively reviewing quarantined messages and unblocking safe URLs, with progress reported but no final resolution time provided. Admins note repeated false positives in past incidents and are advised to monitor the Microsoft 365 admin center, report false positives, and consider layered defenses while avoiding risky policy bypasses.