Check ID: defender_safelinks_policy_enabled
Provider: Microsoft 365
Service: defender
Severity: MEDIUM
Categories: email-security, e5
Resource type: NotDefined

​
What this check verifies

Microsoft Defender for Office 365 Safe Links is a feature that provides URL scanning and rewriting of inbound email messages, as well as time-of-click verification of URLs and links in email messages, Teams, and Office apps. This check verifies that the Safe Links policy is properly configured with all recommended settings enabled.

​
Risk

Without properly configured Safe Links protection, users may be vulnerable to phishing attacks and malicious URLs in emails, Teams messages, and Office documents. Attackers could bypass security by using URLs that redirect to malicious content after initial scanning.

​
Recommendation

Enable and properly configure Safe Links policies to protect users from malicious URLs in emails, Teams, and Office applications. Ensure URL scanning and time-of-click verification are enabled across all communication channels.

​
Remediation

Set-SafeLinksPolicy -Identity ‘Built-In Protection Policy’ -EnableSafeLinksForEmail true−EnableSafeLinksForTeamstrue -EnableSafeLinksForTeams true -EnableSafeLinksForOffice true−TrackClickstrue -TrackClicks true -AllowClickThrough false−ScanUrlsfalse -ScanUrls true -EnableForInternalSenders true−DeliverMessageAfterScantrue -DeliverMessageAfterScan true -DisableUrlRewrite $false

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_safelinks_policy_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks