Some users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation

Title: Some users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation

User impact: Users' email with DocuSign URLs may not have been delivered and may have been quarantined due to URL reputation.

Final status: We've completed manual mitigation of the remaining affected messages and completed implementation of adjustments to our ML model to ensure its correctly sorting email messages containing DocuSign URLs while maintaining the ability to identify and prevent harmful content from reaching users. We've validated from our service telemetry and from a subset of reporting affected users that impact is remediated.

Scope of impact: This issue may have affected some users attempting to send emails with DocuSign URLs, who may have seen messages not being delivered and quarantined due to URL reputation.

Start time: Monday, September 28, 2026, at 2:36 AM UTC

End time: Thursday, October 1, 2026, at 11:59 PM UTC

Root cause: The Microsoft URL evaluation process was incorrectly identifying the affected messages as potentially malicious due to the URL inclusion, resulting in impact.

Next steps:
- We're analyzing our URL evaluation process to validate what additional changes we can implement to ensure similar impact scenarios don't occur in the future while also protecting Exchange Online users from potentially malicious senders.

This is the final update for the event.

Title: Some users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation

User impact: Users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation.

Current status: We're making further manual adjustments to our ML model to ensure its correctly sorting email messages containing DocuSign URLs while maintaining the ability to identify and prevent harmful content from reaching users. We've confirmed that the majority of formerly impacted email messages have been restored, and we're continuing to manually mitigate the remaining affected messages we receive from impacted users as our ML model is being improved.

Scope of impact: This issue may affect some users attempting to send email with DocuSign URLs, who may see messages not being delivered and quarantined due to URL reputation. This section may be updated as the investigation progresses.

Root cause: The Microsoft URL evaluation process is incorrectly identifying the affected messages as potentially malicious due to the URL inclusion, resulting in impact.

Next update by: Monday, October 5, 2026, at 11:30 PM UTC

Title: Some users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation

User impact: Users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation.

Current status: We're continuing to analyze messages containing affected DocuSign URLs to determine what mitigation actions we can implement to prevent our ML model from detecting messages as malicious while still protecting users from harmful content or messages.

Scope of impact: This issue may affect some users attempting to send email with DocuSign URLs, who may see messages not being delivered and quarantined due to URL reputation. This section may be updated as the investigation progresses.

Root cause: The Microsoft URL evaluation process is incorrectly identifying the affected messages as potentially malicious due to the URL inclusion, resulting in impact.

Next update by: Thursday, October 1, 2026, at 11:30 PM UTC

Title: Some users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation

User impact: Users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation.

Current status: After further analysis of impact, we've determined that the scope of impact is wider than initially documented, and we've expanded our communications to all potentially affected users. We've updated the "Title", "User impact", and "Scope of impact" fields to reflect this change. Propagation has completed for our change to add affected DocuSign URLs to our allow lists, but some messages containing affected URLs have not been able to be recovered at this time as they're still being detected by our Machine Learning (ML) model as potentially malicious. We're analyzing affected messages to determine how we can recover the messages in order to fully remediate impact.

Scope of impact: This issue affects some users attempting to send email with DocuSign URLs, who may see message not being delivered and quarantined due to URL reputation. This section may be updated as the investigation progresses.

Root cause: The Microsoft URL evaluation process is incorrectly identifying the affected messages as potentially malicious due to the URL inclusion, resulting in impact.

Next update by: Thursday, October 1, 2026, at 7:30 PM UTC

Title: Some users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation

User impact: Users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation.

Current status: We've determined that the Microsoft URL evaluation process is incorrectly identifying the affected messages as potentially malicious due to the URL inclusion, resulting in impact. We've added the URLs to our allow list to expedite relief to affected users for new email and we're reprocessing the affected messages. This process may take up to 48 hours but the propagation time is typically less than this. We're reaching out to a subset of users to ensure they are seeing resolution.

Scope of impact: This issue affects some users attempting to send email with DocuSign URLs, who may see message not being delivered and quarantined due to URL reputation. This section may be updated as the investigation progresses.

Root cause: The Microsoft URL evaluation process is incorrectly identifying the affected messages as potentially malicious due to the URL inclusion, resulting in impact.

Next update by: Thursday, October 1, 2026, at 9:00 PM UTC

Title: Some users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation

User impact: Users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation.

Current status: We're currently investigating affected network message IDs to find why URL detonation is occurring and determine next steps.

Scope of impact: This issue affects some users attempting to send email with DocuSign URLs, who may see message not being delivered and quarantined due to URL reputation. This section may be updated as the investigation progresses.

Next update by: Thursday, October 1, 2026, at 6:30 AM UTC

Title: Some users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation

User impact: Users' email with DocuSign URLs may not be delivered and may be quarantined due to URL reputation.

Current status: We're investigating a potential issue with Exchange Online and checking for impact to your organization. We'll provide an update within 30 minutes.