Security Policy Errors

How to Fix Microsoft Defender Blocking SendGrid Tracking Links

Maira Mehtab Sep 27, 2026 869 views

Question details

Users report that Microsoft Defender is incorrectly classifying SendGrid-wrapped email URLs as malicious, which disrupts click tracking and prevents email links from functioning properly.

Product: Microsoft Defender / SendGrid
Device & OS: not provided
Scenario: Sending emails with click tracking enabled via SendGrid and integrating with a CRM.
Observed behavior: Legitimate tracking links generated by SendGrid are blocked by Microsoft Defender, often because shared SendGrid IPs are flagged for irregular mail traffic.

Before you start

Ensure you have administrator access to your Microsoft 365 Defender portal to submit false-positive reports, and access to your SendGrid dashboard if you need to adjust tracking settings.

Solution 1Recommended

Submit a False Positive Report in Microsoft Defender

Reporting the blocked SendGrid URL as a false positive prompts Microsoft to review the URL classification and adjust the block for your tenant.

If a shared SendGrid IP address has been flagged for irregular mail traffic, submitting individual URL reports helps Microsoft identify legitimate business traffic. Be aware that this can sometimes be a repetitive process if new links continue to be flagged.

Log in to the Defender Portal

Navigate to the Microsoft 365 Defender portal (security.microsoft.com) and log in using your administrator credentials.

Access the Submissions Page

Go to the 'Actions & Submissions' section in the left-hand navigation menu and click on 'Submissions'.

Add a New URL Submission

Select the 'URLs' tab and click the 'Add new submission' button.

Submit as False Positive

Enter the specific SendGrid tracking URL that is being blocked, select 'Should not have been blocked (False positive)' as the submission type, and submit the request.

Mitigation Eligibility: Microsoft may occasionally state that an IP is ineligible for mitigation. In these cases, consistent false-positive reporting from tenant admins is crucial.

Solution 2

Temporarily Disable SendGrid Click Tracking

If you need an immediate fix and your workflow permits it, disabling click tracking removes the SendGrid URL wrapper, allowing original links to pass through Defender.

Solution 3

Use an Alternative SMTP Provider

If click tracking is strictly required for your CRM and Microsoft continues to block SendGrid's IPs, consider routing your mail through a different SMTP provider.

Free Microsoft Office alternative

Looking for a Hassle-Free Office Suite? Try WPS Office

While resolving email tracking and security policies requires navigating complex administrative portals, creating your daily documents shouldn't be difficult. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office, letting you seamlessly edit Word, Excel, and PowerPoint files without expensive subscriptions.

1. Download WPS Office: Visit the official WPS website and download the free installer for your operating system.
2. Install the Software: Run the setup file and follow the on-screen instructions to complete the fast installation process.
3. Open Your Office Files: Launch WPS Office and directly open your existing Microsoft Word, Excel, or PowerPoint documents without needing to convert them.

Fully compatible with Microsoft Office formats like .docx, .xlsx, and .pptx.Lightweight installation with blazing fast startup speeds.Familiar user interface for a seamless transition.Built-in PDF editing, conversion, and annotation tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why is Microsoft Defender suddenly blocking my SendGrid links?

Microsoft Defender relies on automated threat intelligence. If a shared SendGrid IP address handles irregular or spam-like mail traffic from other users on that IP, Defender may flag the entire IP block, thereby classifying your legitimate tracking links as malicious.

Can I whitelist SendGrid URLs in my Microsoft 365 tenant?

Yes, tenant administrators can manually add specific URLs or domains to the Tenant Allow/Block List in the Microsoft 365 Defender portal to prevent them from being blocked.

Will disabling click tracking affect my CRM integration?

Yes. If your CRM relies on tracking data to trigger workflows or measure user engagement, disabling SendGrid's click tracking will stop that data collection, as the original links will no longer route through the tracking servers.

How long does it take for Microsoft to process a false-positive report?

Microsoft typically processes false-positive URL submissions within 24 hours. However, if the underlying IP address remains flagged by broader security definitions, the issue may reoccur.

Microsoft Office Security Issues