Security Policy Errors

How to Report Legitimate Emails Incorrectly Marked as Malicious in Microsoft 365

Steven Parker Oct 21, 2026 868 views

Question details

Users need to resolve an issue where legitimate newsletters and business messages are incorrectly quarantined or classified as phishing by Microsoft security filters.

How to Report Legitimate Emails Incorrectly Marked as Malicious in Microsoft 365

Product: Microsoft 365, Outlook, Microsoft Defender
Device & OS: not provided
Scenario: A user or business sends valid emails to clients or colleagues, but the messages are blocked, quarantined, or sent to the junk folder due to false-positive security detections.
Observed behavior: Legitimate email communications fail to reach the recipient's inbox because they are incorrectly flagged as malicious, phishing, or spam by Microsoft's automated systems.

Before you start

Ensure you have the original email message details or the actual message file, and confirm whether the affected recipient is internal to your organization or an external client.

Solution 1Recommended

Submit the Message via the Microsoft 365 Defender Portal

Recommended when you have administrator access to the affected recipient's Microsoft 365 tenant.

If the email was sent to a user within an organization you manage, you can use the Submissions page in the Microsoft Defender portal to report the message as incorrectly classified.

Access Microsoft Defender

Ask the affected Microsoft 365 administrator to log in to the Microsoft Defender security portal using their admin credentials.

Navigate to the Submissions page

In the left-hand navigation pane, go to the 'Actions & submissions' section and click on 'Submissions'.

Submit the affected message

Select the 'Emails' tab, click 'Submit to Microsoft for analysis', upload the original message or enter the network message ID, and mark it as 'Should not have been blocked'.

Submit the Message via the Microsoft 365 Defender Portal

Wait for Analysis: Microsoft typically reviews submissions quickly to adjust their filtering rules and prevent future false positives.

Solution 2

Instruct External Administrators to Submit the Report

Use this method when the affected recipients are your clients or outside your organization.

Free Microsoft Office alternative

Experience a Hassle-Free Office Suite with WPS Office

While Microsoft 365's strict security policies can sometimes hinder email communication, creating your essential documents shouldn't be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office, ensuring your workflow remains smooth and uninterrupted.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your device.
2. Install the Software: Follow the simple on-screen instructions to quickly install the suite without any bloatware.
3. Open Microsoft Office Files: Double-click any existing Word, Excel, or PowerPoint file to instantly open and edit it in WPS Office with perfect formatting preservation.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Lightweight installation with a clean, intuitive, and familiar user interfaceBuilt-in robust PDF editor to help secure your documents before emailingFree to use, reducing your overall software subscription costs

microsoft office alternative - wps office

Frequently Asked Questions

Why did Microsoft classify my legitimate business email as malicious?

Microsoft's automated filters analyze sender reputation, URLs, and message content. A legitimate email might trigger a false positive due to a newly registered domain, suspicious keywords, or missing email authentication records like SPF, DKIM, and DMARC.

Can I submit a false-positive report on behalf of an external client?

No. For security and privacy reasons, only the IT administrator or the email hosting provider of the affected recipient's organization can submit a message to Microsoft for analysis.

How do I find the Submissions page in Microsoft 365?

An administrator must log in to the Microsoft Defender portal, expand the 'Actions & submissions' menu on the left-hand navigation pane, and select 'Submissions' to report the incorrect classification.

Microsoft Office Security Issues