Each domain has a Safe Link policy applied to it
ORCA.226MediumDefenderSafe Links
Part of ORCA · Defender · Safe Links · All checks
Invoke-Maester -TestId ORCA.226Overview
Section titled “Overview”Microsoft Defender for Office 365 Safe Links policies are applied using rules. The recipient domain condition is the most effective way of applying the Safe Links policy, ensuring no users are left without protection. If polices are applied using group membership make sure you cover all users through this method. Applying polices this way can be challenging, users may left unprotected if group memberships are not accurate and up to date. It is important not to rely on the ‘built-in’ Safe Links policy, as this policy only applies the minimum level of protections and should serve as a catch-all.
Remediation action
Section titled “Remediation action”Apply a Safe Links policy to every domain.
Related Links
Section titled “Related Links”- Microsoft 365 Defender Portal - Safe links
- Order and precedence of email protection
- Recommended settings for EOP and Microsoft Defender for Office 365
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | ORCA.226 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566.002 Spearphishing Link, T1204.001 Malicious Link |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA226 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
Section titled “Source”- Test:
tests/orca/Test.ORCA.226.ps1 - Documentation:
tests/orca/Test.ORCA.226.md