{
  "id": "CB-M365-MAIL-028",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-028",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-028.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-028.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-028",
    "title": "Check links at time of click with Safe Links in email, Teams and Office for all recipients",
    "finding": {
      "title": "Links in email, Teams and Office documents are not checked when users click them",
      "description": "A link that turns malicious after delivery, or that points to a malicious file, opens without warning, and users may be allowed to click through a warning."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-office-365",
      "safe-links",
      "phishing",
      "url-protection",
      "teams"
    ],
    "applicability": {
      "requires": [
        "Microsoft Defender for Office 365 Plan 1"
      ]
    },
    "description": "Every recipient is covered by a Safe Links policy (the Standard or Strict preset, or a custom\npolicy applied to all accepted domains) with the Standard values:\n\n- email: Safe Links on (`EnableSafeLinksForEmail $true`), applied to messages sent inside the\n  organization (`EnableForInternalSenders $true`), real-time scanning of suspicious links and links\n  to files (`ScanUrls $true`), delivery after scanning (`DeliverMessageAfterScan $true`), URLs\n  rewritten (`DisableUrlRewrite $false`);\n- Teams (`EnableSafeLinksForTeams $true`) and Office apps (`EnableSafeLinksForOffice $true`);\n- clicks tracked (`TrackClicks $true`) and no click-through to the original URL\n  (`AllowClickThrough $false`);\n- a short, reviewed **Do not rewrite the following URLs** list.\n\nNo mail flow rule skips Safe Links (rules that set the\n`X-MS-Exchange-Organization-SkipSafeLinksProcessing` header).\n",
    "rationale": "Attackers send clean links and arm them after delivery, or point to file downloads. Time-of-click\nchecks catch both, internal scanning catches phishing sent from a compromised internal account,\nand blocking click-through stops users from overriding the warning. Click tracking tells the SOC\nwho clicked a link found to be malicious later.\n",
    "impact": "Users see rewritten links in email. Messages with links can be delayed while URLs are scanned.\nClick data is kept for investigations; inform users and staff representatives as required.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Safe\n   Links** and check that the Standard (or Strict) preset or a custom policy covers all\n   recipients with the values above.\n3. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-SafeLinksPolicy | Format-List Name, EnableSafeLinksForEmail, EnableForInternalSenders, ScanUrls, DeliverMessageAfterScan,\n     DisableUrlRewrite, EnableSafeLinksForTeams, EnableSafeLinksForOffice, TrackClicks, AllowClickThrough, DoNotRewriteUrls\n   Get-SafeLinksRule | Format-List Name, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*\n   Get-TransportRule | Where-Object { $_.SetHeaderName -like '*SkipSafeLinksProcessing*' } | Format-Table Name, State\n   ```\n4. Fail if some recipients are only covered by the Built-in protection preset or by a policy that\n   misses one of the values above, or if a mail flow rule skips Safe Links.\n"
    },
    "remediation": {
      "manual": "1. Prefer the preset: apply the Standard preset to all recipients (CB-M365-MAIL-019).\n2. For a custom policy, in **Safe Links**, edit the policy (Security Administrator): **URL & click\n   protection settings** with every option above selected, **Let users click through to the\n   original URL** cleared, and users and domains set to all accepted domains.\n3. PowerShell equivalent:\n   ```powershell\n   Set-SafeLinksPolicy -Identity \"<policy>\" -EnableSafeLinksForEmail $true -EnableForInternalSenders $true -ScanUrls $true `\n     -DeliverMessageAfterScan $true -DisableUrlRewrite $false -EnableSafeLinksForTeams $true -EnableSafeLinksForOffice $true `\n     -TrackClicks $true -AllowClickThrough $false\n   ```\n4. Remove or rewrite the mail flow rules that skip Safe Links.\n",
      "rollback": "Restore the previous values on the custom policy.\n"
    },
    "references": [
      {
        "title": "Safe Links in Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/safe-links-about",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set up Safe Links policies in Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/safe-links-policies-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommended settings for EOP and Microsoft Defender for Office 365 security",
        "url": "https://learn.microsoft.com/defender-office-365/recommended-settings-for-eop-and-office365",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft 365 security suite baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-105, 113, 156, 179, 226, 236, 237, 238, 189-2)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.7.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.7.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.7.3v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.002"
      },
      {
        "framework": "mitre-attack",
        "id": "T1204.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-019",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}