Microsoft is investigating a configuration error in Defender for Office 365 that causes legitimate Google search result links to be treated as threats. Home users, small and medium businesses, and enterprise customers running Microsoft Windows Defender have reported the issue.
When users click the affected links they see the warning “This website may be unsafe.” Copying the URL and pasting it into a browser does not bypass the block. The problem is registered under advisory number MO1465962.
The root cause is an incorrect classification performed by the Safe Links component. Instead of allowing normal Google URLs, the system marks them as malicious and blocks navigation. Safe Links normally protects organizations by rewriting URLs in incoming email and re-evaluating them at click time; the mechanism operates across email, Teams, and other Microsoft 365 applications.
Security teams are also impacted. Administrators receive related alerts and must investigate incidents that appear in the Microsoft Defender Portal and in the Microsoft Sentinel SIEM platform. These alerts consume analyst time without indicating any real phishing campaign.
Microsoft has classified the problem as an advisory, typically indicating limited scope, and is working to correct the faulty classification rules. The company has not yet published details on the number of affected customers or the regions involved.
