Microsoft 365 Exchange URL Filtering Update Quarantines Legitimate Emails as Phishing
A recent update to Microsoft Exchange Online's URL filtering rules caused legitimate emails to be flagged as phishing, resulting in widespread disruptions. This incident began on Mon, Feb 9, 2026, and affected email workflows globally by quarantining…
A recent update to Microsoft Exchange Online's URL filtering rules caused legitimate emails to be flagged as phishing, resulting in widespread disruptions. This incident began on Mon, Feb 9, 2026, and affected email workflows globally by quarantining non-threatening emails.
Microsoft identified this issue under reference EX1227432 . The problem was resolved on Fri, Feb 13, 2026, following a comprehensive remediation process that involved releasing improperly quarantined emails.
The root cause of the disruption was an erroneous logic in a URL filtering rule designed to enhance the detection of sophisticated phishing and spam campaigns. This error led to the unintended flagging of legitimate URLs present in ordinary business communications.
The Exchange Online anti-spam engine quarantined messages that posed no actual threat, which resulted in the prevention of expected correspondence and disrupted successful email delivery.
Event Date & Time
Incident Reported Mon, Feb 9, 2026, 08:30 AM
A recent update to Microsoft Exchange Online's URL filtering rules caused legitimate emails to be flagged as phishing, resulting in widespread disruptions.
Preliminary Root Cause Identified Mon, Feb 9, 2026
Message Release Initiated Feb 9–13, 2026
Final Resolution Confirmed Fri, Feb 13, 2026, 09:01 AM
Microsoft successfully released all quarantined messages before closing the incident. The company acknowledged the need to refine URL rule implementation processes to prevent similar false-positive detections in the future.
Microsoft emphasized its ongoing commitment to adapting anti-phishing defenses in response to evolving spam and phishing tactics. The challenge remains to balance between aggressive detection and minimizing the impact on legitimate email transmissions.
Organizations using Exchange Online, particularly in healthcare and public sector environments, are advised to audit quarantine folders regularly and configure notification systems to avoid delays in time-sensitive communications.
Microsoft Exchange Online's anti-phishing infrastructure is a critical defense layer for enterprise clients, highlighting the importance of careful rule validation and staged rollouts to prevent future incidents.
Based on reporting by Cyber Security News.