Skip to main content
Version: 2.1.0

ORCA.189.2 - Safe Links is not bypassed.

Overview

Microsoft Defender for Office 365 Safe Links can help protect against phishing attacks by providing time-of-click verification of web addresses (URLs) in email messages and Office documents. The protection can be bypassed using mail flow rules which set the X-MS-Exchange-Organization-SkipSafeLinksProcessing header for email messages.

Remediation action

Remove mail flow rules which bypass Safe Links.

Test Metadata

FieldValue
Test IDORCA.189.2
SeverityHigh
SuiteORCA
CategoryEXO
PowerShell testTest-ORCA189_2
TagsEXO, ORCA, ORCA.189.2

Source

  • Pester test: tests/orca/Test-ORCA189_2.Tests.ps1
  • PowerShell source: powershell/public/orca/Test-ORCA189_2.ps1