Microsoft 365 Alert – Service Degradation – Microsoft Defender XDR – Users see some internal Microsoft Teams messages with a specific URL aren’t quarantined in Microsoft Defender XDR – ONGOING

30/10/2025 09:20:00 AM

NHSmail Reference: INC46669641

Microsoft Reference: DZ1181454

Issue Status: ONGOING

Issue Description: Users see some internal Microsoft Teams messages with a specific URL aren’t quarantined in Microsoft Defender XDR.

More info: Users see some internal Microsoft Teams messages with a specific URL aren’t quarantined in Microsoft Defender XDR.

Current Update: 03/11/2025 08:30:00 AM – The saturation of the deployment is taking longer than initially anticipated and is currently 70 percent complete. Microsoft now expect the deployment will complete and the issue will be remediated by their next scheduled communications update.

Scope of impact: Your organization is affected by this event, and all users can see internal Microsoft Teams messages with a specific URL that should be quarantined by Microsoft Defender XDR

Root cause: An update to enable Virtual Account authentication introduced an authorization issue that’s preventing Microsoft Defender XDR from quarantining internal Microsoft Teams messages containing a specific URL.

Next update by: Tuesday, November 4, 2025, at 7:00 AM UTC