Microsoft has successfully mitigated an issue in its machine learning model that was erroneously marking legitimate Adobe emails as spam in Exchange Online. The problem, which began on April 22, caused users to receive warnings about potentially malicious URLs when clicking on Adobe links.

According to Microsoft’s advisory (EX1061430), the machine learning system that protects Exchange Online was incorrectly identifying legitimate emails as spam due to their similarity to known spam patterns. To resolve the issue, Microsoft implemented Replay Time Travel (RTT) on the affected URLs and improved the machine learning logic to reduce false positive rates.

The incident appears to have had broader implications, as online malware analysis service ANY.RUN reported an unusual surge in Adobe Acrobat Cloud links being submitted by Microsoft Defender XDR users. “This caused free-plan users to upload more than a thousand Adobe files with sensitive corporate data of hundreds of companies for analysis in public mode,” ANY.RUN stated, prompting them to make these analyses private to prevent data leaks.

This isn’t the first time Microsoft has faced similar challenges. In recent months, the company has addressed multiple Exchange Online false positives, including issues that incorrectly quarantined emails, flagged image-containing emails as malicious, and mistakenly marked outbound emails as spam.

While Microsoft didn’t specify the exact scope of affected users or regions, the company classified this as a limited service issue that has now been resolved.