# Safe Links policies in Microsoft Defender for Office 365 are configured to scan and block malicious URLs
Safe Links is the Microsoft Defender for Office 365 control that protects users from malicious URLs at the moment of click rather than only at delivery…
Source: https://maester.dev/docs/tests/ZTA.41032
## Overview
Safe Links is the Microsoft Defender for Office 365 control that protects users from malicious URLs at the moment of click rather than only at delivery time. Threat actors routinely defeat one-time URL scanning by sending email or Teams messages that contain links to pages that are still benign when the message arrives and are weaponized hours or days later — pointing to credential-harvesting forms, drive-by exploit kits, or convincing fake login pages that capture passwords and session cookies. Safe Links wraps every URL so each click is checked against Microsoft's URL reputation service in real time, regardless of when the message was delivered or where the user clicks it (email, Teams chat, or supported Office desktop and web apps). Without Safe Links, an organization is blind to delayed weaponization across its primary collaboration surfaces, and a single successful credential capture can give threat actors a foothold for lateral phishing, business email compromise, or ransomware staging. Microsoft offers an allow list for known-safe URLs and a no-rewrite mode that preserves the time-of-click reputation check while leaving the original URL intact, so coverage does not require visible URL changes if that is operationally important.
## Remediation
- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Configure Safe Links policies](https://learn.microsoft.com/en-us/defender-office-365/safe-links-policies-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Set-SafeLinksPolicy](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Preset security policies](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Email and collaboration security |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| ATT&CK | [T1566.002](/docs/tests?mitre=T1566.002) Spearphishing Link, [T1204.001](/docs/tests?mitre=T1204.001) Malicious Link |
| Licence | ATP_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.