Microsoft Exchange Online Flagging Gmail Emails as Spam – Fixes Issued

Microsoft has resolved a widespread issue with its Exchange Online service that caused legitimate emails from Gmail accounts to be incorrectly identified as spam and quarantined. The problem, which began on April 25, affected numerous organizations using Microsoft 365 and was formally tracked under incident code EX1064599. According to Microsoft’s official statement, the issue was […] The post Microsoft Exchange Online Flagging Gmail Emails as Spam – Fixes Issued appeared first on Cyber Security News.

May 2, 2025 - 14:23

Microsoft Exchange Online Flagging Gmail Emails as Spam – Fixes Issued

Microsoft has resolved a widespread issue with its Exchange Online service that caused legitimate emails from Gmail accounts to be incorrectly identified as spam and quarantined.

The problem, which began on April 25, affected numerous organizations using Microsoft 365 and was formally tracked under incident code EX1064599.

According to Microsoft’s official statement, the issue was traced to a faulty machine learning (ML) model used in Exchange Online Protection (EOP) that incorrectly classified legitimate Gmail messages as “High Confidence Phish” with a Spam Confidence Level (SCL) of 8.

This classification automatically moved the emails to quarantine, preventing them from reaching intended recipients.

“We’ve identified that our machine learning model, which safeguards Exchange Online against risky email messages, is incorrectly identifying legitimate email messages as spam due to their similarity to email messages used in spam attacks, which is resulting in impact,” Microsoft explained in its initial acknowledgment of the problem.

Microsoft ML Model After Inconsistent Gmail Quarantine Issue

The most confusing aspect of the issue for administrators was its inconsistent behavior. Users reported scenarios where identical emails sent to multiple recipients within the same organization would be delivered to some inboxes while being quarantined for others.

This randomness complicated troubleshooting efforts and created confusion among IT administrators. Microsoft engineers addressed the problem by reverting to a previous version of the ML model.

In their final update on May 1, Microsoft confirmed: “After a period of monitoring, we’ve confirmed through our service health telemetry that the completion of reverting to the previous ML model has successfully remediated impact”.

During the six-day incident, system administrators could implement workarounds to mitigate the issue. Microsoft suggested creating custom allow rules to ensure Gmail messages weren’t incorrectly flagged.

Options included using the Tenant Allow/Block List or creating Transport Rules in Exchange Online.

This rule would set the SCL value to -1 for messages from Gmail domains, effectively instructing the system to bypass spam filtering for these messages.

The incident represents the latest in a series of false-positive detection issues affecting Microsoft’s email filtering systems.

Just last week, Microsoft mitigated another machine learning issue that incorrectly flagged Adobe emails as spam, and in March addressed a similar problem causing incorrect quarantining of legitimate messages.

Microsoft has indicated they are “continuing to investigate opportunities to improve our ML detection process to reduce false positive detections and prevent similar future impact”.

For organizations still experiencing issues with Gmail emails, Microsoft recommends checking the Microsoft 365 admin center for the latest updates on service incidents.

As cloud-based email platforms continue to evolve, ongoing collaboration between vendors, IT professionals, and the user community will be essential to ensure both security and reliability in digital communications.

Are you from the SOC and DFIR Teams? – Analyse Real time Malware Incidents with ANY.RUN -> Start Now for Free.

The post Microsoft Exchange Online Flagging Gmail Emails as Spam – Fixes Issued appeared first on Cyber Security News.