Safe Links policies in Microsoft Defender for Office 365 are configured to scan and block malicious URLs

Overview

Safe Links is the Microsoft Defender for Office 365 control that protects users from malicious URLs at the moment of click rather than only at delivery time. Threat actors routinely defeat one-time URL scanning by sending email or Teams messages that contain links to pages that are still benign when the message arrives and are weaponized hours or days later — pointing to credential-harvesting forms, drive-by exploit kits, or convincing fake login pages that capture passwords and session cookies. Safe Links wraps every URL so each click is checked against Microsoft’s URL reputation service in real time, regardless of when the message was delivered or where the user clicks it (email, Teams chat, or supported Office desktop and web apps). Without Safe Links, an organization is blind to delayed weaponization across its primary collaboration surfaces, and a single successful credential capture can give threat actors a foothold for lateral phishing, business email compromise, or ransomware staging. Microsoft offers an allow list for known-safe URLs and a no-rewrite mode that preserves the time-of-click reputation check while leaving the original URL intact, so coverage does not require visible URL changes if that is operationally important.

Remediation

• Safe Links in Microsoft Defender for Office 365
• Configure Safe Links policies
• Set-SafeLinksPolicy
• Preset security policies

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Email and collaboration security
Product	Defender
Feature	Safe Links
Area	Email and collaboration protection
ATT&CK	T1566.002 Spearphishing Link, T1204.001 Malicious Link
Licence	ATP_ENTERPRISE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.