Microsoft Exchange Online faced a major service disruption starting February 5, 2026, when legitimate business emails began getting incorrectly flagged as phishing attempts and quarantined. The incident, tracked as EX1227432, affected organizations worldwide and continues as Microsoft works to restore normal email flow. According to Windows Central’s official coverage, the problem stems from an overly aggressive URL detection rule deployed by Microsoft’s anti-spam systems.
The faulty filter disrupted critical business communications, trapping both inbound and outbound messages in quarantine folders. IT administrators across enterprises scrambled to manually release legitimate emails while Microsoft engineers worked to identify and fix the root cause. This incident joins a pattern of similar Exchange Online anti-spam false positives that have occurred throughout 2025, affecting everything from data breach notifications to routine business correspondence.
Exchange Online Email Crisis Tracker
INCIDENT: EX1227432đź“… Incident Timeline
10:31 AM EST
Microsoft Exchange Online starts incorrectly flagging legitimate emails as phishing attempts
Service alert issued confirming URLs associated with emails are incorrectly marked as phishing
Weekend
Microsoft confirms new URL rule is incorrectly quarantining legitimate messages
Ongoing
Engineers reviewing quarantined messages and unblocking legitimate URLs
🔍 How The Problem Works
đź“Š Business Impact
What Went Wrong
🔧 Check Your Email Status
Enter your organization’s domain to see if you might be affected by this incident
đź“ś Recent Exchange Online False Positive History
🛠️ What IT Teams Should Do
đź”— Related Coverage & Resources
The EX1227432 incident was discussed, covering the timeline from February 5 through February 10, 2026, the technical root cause involving an overly aggressive URL detection rule, and the business disruption experienced by Exchange Online users. Microsoft’s ongoing remediation efforts were outlined, including the manual release of quarantined emails and unblocking of legitimate URLs.
IT administrators facing similar issues can reference the workaround steps provided and monitor the Microsoft 365 Admin Center for real-time updates on incident resolution. The historical pattern of false positives in Exchange Online’s anti-spam systems was also documented. For organizations concerned about incident response preparedness, this situation provides a case study in cloud service disruptions and the importance of monitoring quarantine folders during such events.
