The problem does not seem to originate from the destination websites themselves, but rather from the way Google formats its redirect URLs. When a user clicks a search result, Google briefly routes the request through a tracking or forwarding prefix before sending the user to the final page. Defender for Office 365 is reportedly misreading this standard URL structure as a potential phishing or malware vector, leading to false positives.

Microsoft has acknowledged the reports and stated that its team is actively investigating the root cause. While no workaround has been officially provided yet, administrators experiencing this issue have noted that temporarily disabling URL detonation or link safety checks in the security policy may restore normal functionality—though this is not recommended as a long-term solution due to the increased risk.

Affected users are encouraged to monitor the Microsoft 365 admin center for service health notifications. The company has not yet specified a timeline for a permanent fix.

• Affected service: Defender for Office 365 (link and URL protection features)
• Trigger: Clicking legitimate Google search result links
• Current status: Under active investigation by Microsoft
• Temporary mitigation (not advised long-term): Disabling link safety checks in security policies

Source: Unknown

Has your organization encountered this false-positive issue with Defender for Office 365, and are you applying any interim filtering rules while waiting for the official patch?