Microsoft 365 Alert – Service Degradation – Microsoft Defender XDR – Users see some internal Microsoft Teams messages with a specific URL aren’t quarantined in Microsoft Defender XDR – FALSE POSITIVE

30/10/2025 09:20:00 AM

NHSmail Reference: INC46669641

Microsoft Reference: DZ1181454

Issue Status: FALSE POSITIVE

Issue Description: Users see some internal Microsoft Teams messages with a specific URL aren’t quarantined in Microsoft Defender XDR.

More info: Users see some internal Microsoft Teams messages with a specific URL aren’t quarantined in Microsoft Defender XDR.

Final Update: 03/11/2025 08:30:00 AM – Microsoft have determined that this issue is a duplicate of another event. Please look for further updates in DZ1181325.

Scope of impact: Your organization is affected by this event, and all users can see internal Microsoft Teams messages with a specific URL that should be quarantined by Microsoft Defender XDR

Root cause: An update to enable Virtual Account authentication introduced an authorization issue that’s preventing Microsoft Defender XDR from quarantining internal Microsoft Teams messages containing a specific URL.