Microsoft false positive report. Admins can report good (false positives) and bad (false negative) messages, email attachments, and URLs (entities) from the available tabs on the Submissions page. A false negative is an entity that wasn't detected as a threat, even though it actually is malicious. Defender for Office 365 can help admins understand why legitimate emails are being blocked, how to resolve the situation quickly, and prevent similar situations from happening in the future. When you report a false positive, Microsoft's system will analyze the email and adjust its filters to prevent similar messages from being flagged as spam in the future. . Microsoft Defender for Office 365 helps deal with important legitimate business emails that are mistakenly blocked as threats (False Positives). Admins can also submit user reported messages from the User reported tab on the Submissions page to Microsoft for analysis. False positives/negatives can occur with any threat protection solution, including Defender for Endpoint. Fortunately, steps can be taken to address and reduce these kinds of issues. Typically, reporting a false positive to Microsoft from a quarantined email does help improve the accuracy of Microsoft's filtering system. Was something missed or wrongly detected by AIR in Microsoft Defender for Office 365? Learn how to submit false positives or false negatives to Microsoft for analysis. Submit files you think are malware or files that you believe have been incorrectly classified as malware. Was something missed or wrongly detected by AIR in Microsoft Defender for Office 365? Learn how to submit false positives or false negatives to Microsoft for analysis. Was something missed or wrongly detected by AIR in Microsoft Defender XDR? Learn how to submit false positives or false negatives to Microsoft for analysis. Microsoft security researchers analyze suspicious files to determine if they are threats, unwanted applications, or normal files. eksecjsovwqopwozlghrlygpqpzqvnmvseyrizofqfxxuh