An email can reach a mailbox before its destination becomes malicious or its attachment is recognised as a threat. Microsoft Defender for Office 365 adds protection for these situations through Safe Links and Safe Attachments. Safe Links evaluates URLs, including when users click them. Safe Attachments analyses attachments in a virtual environment before allowing normal access, according to the applicable policy and delivery action.
Part 1 introduced the Microsoft Defender XDR portal and incident queue. In Part 2, we move from the investigation workspace to two preventive controls that influence what reaches users and what happens when they interact with it. The objective is not simply to enable both features: it is to establish predictable coverage, understand delivery behaviour and verify the result. By Muhammad Ahsan, Solution Savy.
1. Establish the protection boundary and licensing
Safe Links and Safe Attachments are available in Microsoft Defender for Office 365 Plan 1 and Plan 2, including subscriptions that contain those plans. They extend the baseline email protections provided by Exchange Online Protection; they do not replace anti-malware, anti-spam or anti-phishing policies. Before changing settings, confirm the licensing that covers your intended users and distinguish the protection features from the investigation tools available in your subscription.
Safe Links protects supported email, Microsoft Teams and Office application scenarios, but the mechanism differs by workload. Email protection commonly uses URL rewriting, while Teams and supported Office applications use their own Safe Links integration. Do not assume every application, link format or access path behaves identically. Microsoft documents workload requirements and limitations, which should inform your test plan.
Safe Attachments for email is also distinct from Safe Attachments protection for SharePoint, OneDrive and Microsoft Teams. Those services have separate enablement and handling considerations. An email policy is not evidence that collaboration-file protection has been configured correctly. Keep this deployment focused on email, but record collaboration protection as a separate verification task.
Inventory the licences, recipients, mail flow and supported client applications in scope.
Identify who can administer the policies and who can investigate or release quarantined items. Use roles appropriate to those tasks rather than routine Global Administrator access.
Record current policies and exceptions before making changes, including any settings supplied by preset security policies.
2. Choose a policy model before changing individual settings
In the Microsoft Defender portal, use Email & collaboration > Policies & rules > Threat policies to review preset security policies, Safe Links and Safe Attachments. Microsoft provides Standard and Strict preset security policies containing coordinated protection settings. For many organisations, these are a more maintainable starting point than a collection of individually tuned policies. Strict applies a more restrictive protection profile; assess its operational effect before expanding coverage.
Policy precedence matters. For Safe Links and Safe Attachments, Strict preset protection takes precedence over Standard, followed by applicable custom policies and then Built-in protection. Within custom policies, a lower numerical priority represents a higher priority. Settings from multiple applicable policies are not merged into a single stronger configuration. A custom policy cannot override a preset policy that takes precedence for the same recipient.
Built-in protection provides a baseline for recipients who are not covered by other applicable Safe Links or Safe Attachments policies, subject to its exclusions. This is useful coverage, but it is not a substitute for an intentional Standard or Strict deployment. Also, the two policy types are evaluated separately: a recipient's Safe Links coverage does not establish which Safe Attachments policy applies.
Define a representative pilot group covering ordinary users, privileged staff, mobile users and attachment-heavy business processes.
Check whether pilot recipients already fall within a higher-precedence preset policy before creating a custom test policy.
Use custom policies for a documented requirement, not simply to reproduce a preset. Assign an owner and review date to each exception.
Document the effective policy for representative recipients, not just the existence of a policy bearing the right name. This avoids a common deployment error: testing settings that never apply to the selected users.
3. Configure Safe Links around click-time protection
Safe Links scans URLs in incoming email and can rewrite them so that a click is evaluated through the service. This matters because a destination's reputation or content can change after message delivery. If Safe Links determines that a destination is malicious, it presents a warning or blocking experience according to the policy. A successfully delivered message therefore does not mean every destination in it will remain accessible.
For email, URL rewriting is the usual protection model. Microsoft also supports an API-based checking option without rewriting for supported Outlook clients. That option should not be treated as universally equivalent across all clients. If you choose it, validate the exact client coverage and understand what happens when recipients use a client that does not support the required integration.
Confirm that Safe Links protection is enabled for email in the effective policy. Review protection for messages sent within the organisation rather than assuming internal mail is covered.
Review real-time scanning of suspicious links and links to downloadable files. Where configured, waiting for URL scanning before delivery introduces a security-versus-delivery-timing decision that should be tested.
Review the options for Microsoft Teams and supported Office applications separately. Enabling email protection does not establish that every workload option is enabled.
Enable tracking of user clicks where appropriate for investigation requirements. Review the available privacy-related tracking options with your organisation's data governance team.
Do not allow users to click through to the original URL when Safe Links identifies it as malicious unless there is an explicitly approved business requirement.
Treat the list of URLs that should not be rewritten as a narrow compatibility mechanism, not a general trusted-sites catalogue. Microsoft documents that this list changes rewriting behaviour; it should not be assumed to disable every other URL check. Before adding an entry, identify the affected application, reproduce the problem and confirm that the exception actually addresses it. Avoid broad domain exceptions where a specific URL pattern will suffice.
4. Select Safe Attachments delivery behaviour deliberately
Safe Attachments adds analysis beyond the initial anti-malware checks. It uses a virtual environment to examine attachments for malicious behaviour. The policy action determines how messages are handled while that analysis takes place and when a threat is detected. The operational question is therefore not only whether analysis runs, but also when the recipient receives the message and gains access to the attachment.
Block is an appropriate baseline where the business can accept the delivery behaviour associated with waiting for analysis. Messages containing attachments identified as malicious are quarantined. Dynamic Delivery offers a different experience for supported Exchange Online mailbox scenarios: the message body arrives while attachment placeholders remain until analysis completes. If the attachment is safe, it becomes available; if it is malicious, the message is quarantined.
Dynamic Delivery is not universal. Microsoft documents mailbox and message-handling limitations, so test it against your actual environment before selecting it for a broad population. Explain the placeholder experience to users and the service desk. Without that preparation, expected scanning behaviour can be mistaken for missing attachments or a mail delivery failure.
Choose a protective action deliberately. Monitor observes results but should not be treated as equivalent to blocking malicious content.
Review quarantine settings alongside the detection action. Quarantine policies govern the available user experience and permitted actions; detection alone does not establish the release workflow.
Document how users request help with a suspected false positive and who investigates it before release.
Test representative business attachments and workflows. Where content cannot be inspected as expected, investigate the limitation rather than assuming that delivery proves the content is safe.
Do not make broad attachment exemptions the first response to a business complaint. Preserve the message details, examine the detection and submit a suspected false positive through the supported Microsoft Defender submission workflow where appropriate.
5. Validate coverage and investigate with evidence
Validate configuration and behaviour separately. First confirm that the intended recipients are included, that exclusions are justified and that no higher-precedence policy changes the result. Then exercise normal business workflows using benign material: external and internal messages, common attachment types and the clients users actually employ. Do not send live malicious files or phishing destinations to production users to prove the controls work.
For Safe Links, a rewritten URL can demonstrate rewriting behaviour, but it is not proof of every protection setting or every workload's coverage. For Safe Attachments, confirm delivery behaviour, quarantine handling and the service desk process. Record the recipient, test time, client, expected result and observed result so that later policy changes can be compared against a repeatable baseline.
Where your licensing and permissions provide the relevant advanced hunting data in Microsoft Defender XDR, the UrlClickEvents table supports investigation of Safe Links activity. The following query lists recent click events. It is a triage view, not a verdict on whether an account has been compromised.
UrlClickEvents
| where Timestamp > ago(7d)
| project Timestamp, AccountUpn, Workload, ActionType,
ThreatTypes, IsClickedThrough, Url
| order by Timestamp desc
| take 100Review the action, threat classification and click-through field together. A recorded click is not automatically a successful compromise. Equally, an empty result does not establish that nobody clicked a link: check the time range, data availability, applicable tracking settings and supported workload coverage before drawing that conclusion.
When investigating a suspicious interaction, correlate it with the original message, recipient and relevant incident evidence. If endpoint or identity evidence is available, use it to establish whether execution, credential use or other follow-on activity occurred. Safe Links and Safe Attachments provide preventive controls and investigation evidence; neither removes the need to assess what happened after user interaction.
6. Deployment checklist
Licensing and administrative permissions are confirmed for the deployment and investigation tasks.
Standard, Strict, custom and Built-in protection precedence is understood for representative recipients.
Safe Links email, internal-message, Teams and Office application options have been reviewed separately.
URL exceptions and user click-through behaviour have explicit justification.
Safe Attachments actions, Dynamic Delivery limitations and quarantine handling have been tested.
The service desk has instructions for attachment placeholders, blocked links and suspected false positives.
A repeatable validation record exists, and every exception has an owner and review date.
7. Conclusion: protection depends on effective coverage
Safe Links and Safe Attachments address different stages of the email threat path: interaction with a destination and access to potentially malicious content. Deploy them as complementary controls, using preset security policies where appropriate and custom settings only for clear requirements. The strongest operational outcome is not the largest number of configured options; it is verified coverage, predictable handling and evidence-led investigation.
Once those controls are established, the next step is to assess and improve user response without exposing people to real threats. Part 3 covers Attack simulation training: planning phishing simulations, choosing appropriate scope and turning the results into practical learning.
Safe Links in Microsoft Defender for Office 365
Safe Attachments in Microsoft Defender for Office 365
Configure Safe Attachments policies
Preset security policies and protection precedence
UrlClickEvents advanced hunting schema
Originally published on Solution Savy. Need help with this? Book a consultation.
