A company LinkedIn link in our email signature is being flagged as phishing by Microsoft 365. We removed it from new signatures, but old messages still contain it, so replies in existing email threads can keep getting quarantined by our partners. Is there a practical way to deal with the old threads or get the link cleared more broadly?
How do you handle a signature link getting flagged as phishing?
Asked by
velvet_oar
Answers
For new mail, leaving the link out is the quickest fix. Changing the signature does not remove it from messages already sent, so old threads can still carry the flagged link when someone replies. Ask staff to start a fresh message for urgent conversations and, where needed, let partners know why an old thread may be held.
There probably isn't a switch you can set that makes every recipient's filtering system accept the link. Each organization controls its own filtering, and a local allow rule only helps within that organization.
Reply to this answer
Before treating it as a platform-wide mistake, check the exact URL and message details that triggered the verdict. Confirm whether the link is direct, redirected, shortened, or rewritten by a mail security service. Also check whether your own sending domain or the destination domain has a separate reputation problem.
Submit the message and URL through the relevant false-positive reporting channel, and keep the support case moving with examples from different recipients if you have them. That may help the provider review the detection, but it can't guarantee a global change or immediately clear other organizations' filters.
Reply to this answer
A redirect on your own domain might look tidier, but it is not a dependable workaround. Filters can follow redirects and inspect the final destination. If the link is not essential, remove it. If you want to keep a social link, consider linking to a normal page on your company site that lists your social profiles, then test that setup with a few recipient organizations before rolling it out.
understudy7:
Right, changing the visible link alone may not help if the scanner follows it to the same destination.
Reply to this answer
Keep the fix boring: remove the link from the centrally managed signature, tell staff not to continue sensitive conversations in affected old threads, and give them a short explanation they can send to partners. For anything time-sensitive, a new message without the old quoted signature is the cleanest route.
You can still pursue the false-positive report, but plan as though recipients will need to manage their own filtering until it changes.
Reply to this answer
Add your answer
Answers are reviewed before publication.
velvet_oar:
That matches what we're seeing. The hard part is getting outside contacts to stop replying to the older threads.