Fix Microsoft 365 Quarantining Safe Emails with URLs
Question details
The user needs to prevent Microsoft 365 Defender from quarantining legitimate emails that contain URLs mistakenly classified as phishing.
- Product
- Microsoft 365 Defender
- Device & OS
- not provided
- Scenario
- Receiving safe emails containing valid URLs that are blocked by the system's security filters.
- Observed behavior
- Legitimate emails are quarantined by Microsoft 365 as high-confidence phishing due to URL detonation reputation, even after being reported as safe.
Ensure you have global administrator or security administrator privileges in your Microsoft 365 tenant to access and modify Microsoft 365 Defender threat policies.
Submit False Positive URLs to the Microsoft Security Portal
Directly submit mistakenly flagged URLs to Microsoft for review to correct the system's detonation reputation classification.
When an email is classified as high-confidence phishing due to a URL, releasing the email manually does not fix the underlying URL reputation. You must submit the URL to Microsoft's security team so they can analyze it and update their threat intelligence database.
Log in to the Microsoft 365 Defender portal using your administrator credentials.
In the left navigation pane, scroll down to the 'Email & collaboration' section and select 'Actions & submissions'.
Go to the 'Submissions' tab, click on 'URLs', and select 'Submit to Microsoft for review'. Paste the safe URL that triggered the quarantine and follow the prompts to complete the submission.
Add Safe URLs to the Tenant Allow/Block List
Add verified safe URLs to your tenant's allow list to temporarily bypass the false positive block while Microsoft reviews your submission.
Review Anti-Spam and Mail-Flow Rules
Ensure no conflicting transport rules or overly aggressive anti-spam policies are incorrectly quarantining safe emails.
Try WPS Office for Your Daily Productivity Needs
While resolving Microsoft 365 email quarantine issues requires administrative access to the Defender portal, you can handle all your local document creation and editing securely with WPS Office. It is a free, lightweight, and highly compatible alternative to Microsoft Office.
- 1. Download WPS Office: Visit the official WPS Office website and click the free download button for your PC or Mac.
- 2. Install the Suite: Run the downloaded installer and follow the quick on-screen instructions to set up the software.
- 3. Open Your Files: Launch WPS Office and easily open, edit, and save your existing Word, Excel, and PowerPoint documents.
Frequently Asked Questions
Why does Microsoft 365 quarantine emails that I have reported as safe?
Microsoft 365 Defender uses high-confidence phishing classifications based on URL detonation reputation. This automated security classification can override manual user reports if the system still detects characteristics it believes are malicious.
How long does a URL submission review take in Microsoft 365?
Submissions sent to the Microsoft security submission portal are typically reviewed within a few hours. However, more complex cases or advanced threats can take up to 24 hours to have their reputation score fully updated.
Can I permanently bypass the URL quarantine for specific domains?
Yes, administrators can add verified domains or URLs to the Tenant Allow/Block List in the Microsoft 365 Defender portal. However, these allow entries should be managed carefully and are often designed to be temporary while false positives are officially resolved by Microsoft.
