Microsoft 365 Disruptions: Exchange Online False-Positive Phishing Blocks and Microsoft Teams Service Degradation

Microsoft reported a Microsoft 365 security-service failure in which Exchange Online anti-phishing heuristics incorrectly classified thousands of legitimate URLs as credential-phishing, leading to quarantined emails, blocked link access, and removal of messages via automated actions (including ZAP) across email and Microsoft Teams. The incident (tracked as EX1227432) ran from Feb 5 to Feb 12 and generated false XDR-style alerts such as “potentially malicious URL click was detected”; Microsoft attributed the impact to a logic error in newly updated heuristic detection, with additional tooling and a separate signature-system bug compounding and delaying rollback.

Separately, Microsoft also worked an active Microsoft Teams outage/service degradation (tracked as TM1233974) affecting some users in the United States and Europe, with delays/failures sending and receiving chats that include inline media and issues joining meetings or signing in. A third item—abuse of Atlassian Jira Cloud notification emails to deliver localized scam lures and redirect victims to casino/investment fraud—describes a distinct threat campaign unrelated to the Microsoft 365 incidents and should be treated as a separate story.