Microsoft Defender for Office 365 false-positives block Google links

Wed, 02 Sep 2026 15:05:08 +0000

Engineer — Plan: If your org uses Defender for Office 365, check whether Safe Links is blocking legitimate Google URLs and configure allow-list exceptions or monitor Microsoft’s investigation for a fix.
SOC/IR — Plan: Expect a spike in user-reported blocked links; tune alert triage to deprioritize Safe Links hits on google.com domains until Microsoft issues a resolution.
Leader — Skip

Microsoft: Ignore False 'Antivirus Turned Off' Alerts After Defender Update

Mon, 31 Aug 2026 18:00:29 +0000

Engineer — Learn: Defender Antivirus false-positive after recent update may trigger compliance alerts or monitoring noise; no patch or configuration change needed, just awareness that the UI error is benign until Microsoft releases a fix.
SOC/IR — Act: Suppress or contextually tune alerts for Defender ‘antivirus turned off’ events caused by this update so analysts aren’t flooded with false positives; document the known-issue window to avoid masking real AV-disabling activity.
Leader — Skip