Email signature link flagged as phishing in Microsoft 365

A signature link can get the whole message quarantined. Microsoft Defender for Office 365 holds messages it classes as high-confidence phishing, and Microsoft says they are quarantined by default. Safe Senders and most allow lists do not release them. The fix is an admin submission for the false positive, plus a Tenant Allow/Block List entry if the same message needs to keep passing.

This guide covers Microsoft 365 with Defender for Office 365. Google's filters work differently, and this guide does not cover them.

Why is my signature link quarantined?

Defender holds messages it judges to be high-confidence phishing. Microsoft's secure-by-default page says that email "identified as high confidence phishing is quarantined by default," and that the behaviour is not a setting you can turn off. Microsoft Q&A has a thread where a hyperlink in the company signature was the flagged item. Internal mail with the signature was held, while mail without it was delivered. Microsoft does not publish the signals behind a verdict, so confirm the cause in your own quarantine instead of assuming it.

Why doesn't adding the sender to Safe Senders work?

Microsoft does not apply several overrides to malware or high-confidence phishing. The secure-by-default page lists allowed sender and domain lists in anti-spam policies, Outlook Safe Senders, the IP Allow List in the default connection filter, and Exchange mail flow rules. None of them release a held message of this kind. Forum advice to "add the domain to safe senders" fails for this reason.

One exception matters. Secure by default applies only when your MX record points to Microsoft 365. If it points to a third-party filter, the overrides above can deliver the message, and the verdict may be different.

How do I confirm the signature is the cause?

1. Open a held message in the Defender portal quarantine and note the verdict. Admins can release messages. Users can only request release.
2. Send two test emails from the same mailbox to an external address you control: one with the signature, one without. Compare the results.
3. If the signature is the cause, remove one link at a time and send again until the message gets through.

How do I get the message delivered?

Admin steps, following Microsoft's submissions article:

1. Go to Actions & submissions > Submissions in the Defender portal, or open security.microsoft.com/reportsubmission. Make sure the Emails tab is selected.
2. Select Submit to Microsoft for analysis.
3. For the network message ID, use the GUID in the X-MS-Office365-Filtering-Correlation-Id header of the quarantined message. You can also upload the .eml or .msg file.
4. Choose a recipient who had the problem. The policy check uses that recipient.
5. If you know the message is good, select I've confirmed it's clean, then select Next. Select It appears clean only when you want Microsoft to give the verdict.
6. On the second page, select Allow this message to create Tenant Allow/Block List entries for the sender and URLs. Select Submit if you only want the report.
7. If you allow it, choose when the entry expires. The default is 45 days after last use. The other choices are 1 day, 7 days, 30 days, or a specific date no more than 30 days away.
8. Select Submit, then Done. The entries appear on the Tenant Allow/Block Lists page after a few moments.

Why does the fix stop working?

• The allow entry expired. A Microsoft Q&A thread reports that an entry restored delivery, then expired, and some recipients still did not receive mail. Use the default expiry, and check the Tenant Allow/Block List after a week.
• Other checks still run. Microsoft says an allow entry skips the filters tied to that entity only. Other parts of the message are still evaluated, and the message is delivered only if it passes them. Retest after you add the entry.
• Impersonation protection blocked it. No allow entry is created for messages blocked by domain or user impersonation protection. The sender goes into the Trusted senders and domains section of the anti-phishing policy instead.
• The message has expired. Phishing messages held by anti-spam policies stay for 15 days under the default anti-spam policy, or 30 days under the Standard and Strict preset policies. After that Microsoft permanently deletes them. Ask the sender to resend.

How do I keep signature links from triggering this?

Microsoft does not publish a signature checklist, so these are habits, not Microsoft guidance:

• Use your own domain for the website and profile links.
• Skip URL shorteners and link-tracking wrappers. A shortener hides the destination the filter is trying to judge.
• Keep the link count low. Every extra link is one more thing to clear.
• Test any new signature domain with the two-send test before you roll it out to everyone.

How does Sendoff help?

Sendoff cannot change Microsoft's verdict, and it does not check whether a link is on a blocklist. Its signature checker does help before you test. It reports how many links and images the HTML contains, warns about images served over http://, and flags script tags, which some clients reject. Build the signature in the free email signature generator, run the HTML through the checker, then do the two-send test above. For the Microsoft 365 setup, see the Microsoft 365 integration page.

Sources

• Microsoft Learn, "Secure by default in Office 365": https://learn.microsoft.com/en-us/defender-office-365/secure-by-default
• Microsoft Learn, "Quarantined email messages in Microsoft 365": https://learn.microsoft.com/en-us/defender-office-365/quarantine-about
• Microsoft Learn, "Submit messages, URLs, and attachments for analysis in the Microsoft Defender portal": https://learn.microsoft.com/en-us/defender-office-365/submissions-admin
• Microsoft Q&A community thread, "Emails marked as malcious URL but we are safe": https://learn.microsoft.com/en-us/answers/questions/5522965/emails-marked-as-malcious-url-but-we-are-safe