User click tracking SHOULD be enabled

Contributed by Michael Soule with Thomas SchmidtAll contributors →

Part of CISA · Exchange Online · Safe Links · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.15.3

Overview

User click tracking SHOULD be enabled.

Rationale: Users may click on malicious links in emails, leading to compromise or unauthorized data disclosure. Enabling user click tracking lets agencies know if a malicious link may have been visited after the fact to help tailor a response to a potential incident.

Remediation action:

1. Sign in to Microsoft 365 Defender.
2. In the left-hand menu, go to Email & Collaboration > Policies & Rules.
3. Select Threat Policies.
4. From the Templated policies section, select Preset Security Policies.
5. Under either Standard protection or Strict protection, select Manage protection settings.
6. Select Next until you reach the Apply Defender for Office 365 protection page.
7. On the Apply Defender for Office 365 protection page, select All recipients.
8. (Optional) Under Exclude these recipients, add Users and Groups to be exempted from the preset policies.
9. Select Next on each page until the Review and confirm your changes page.
10. On the Review and confirm your changes page, select Confirm.

Related links

• Defender admin center - Preset security policies
• CISA 15 Link Protection - MS.EXO.15.3
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.15.3
Severity	Medium
Suite	CISA
Product	Exchange Online
Related products	Defender
Feature	Safe Links
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566.002 Spearphishing Link, T1204.001 Malicious Link
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.15.3
Criticality	SHOULD
Upstream requirement	Moved to MS.SECURITYSUITE.7.3v1 (was MS.EXO.15.3v1)
Supports controls	cisa-scuba:MS.EXO.15.3, nist-800-53-r5:SI-3, nist-800-53-r5:AU-12c
PowerShell test	Test-MtCisaSafeLinkClickTracking
Services	ExchangeOnline, Graph
Compatible licenses	ATP_ENTERPRISE

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.15.3.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.15.3.md