# yaml-language-server: $schema=../../../../schema/control.schema.json id: CB-M365-MAIL-028 title: Check links at time of click with Safe Links in email, Teams and Office for all recipients finding: title: Links in email, Teams and Office documents are not checked when users click them description: A link that turns malicious after delivery, or that points to a malicious file, opens without warning, and users may be allowed to click through a warning. status: active profiles: [baseline] risk: severity: high assessment: manual tags: [defender-for-office-365, safe-links, phishing, url-protection, teams] applicability: requires: - "Microsoft Defender for Office 365 Plan 1" description: | Every recipient is covered by a Safe Links policy (the Standard or Strict preset, or a custom policy applied to all accepted domains) with the Standard values: - email: Safe Links on (`EnableSafeLinksForEmail $true`), applied to messages sent inside the organization (`EnableForInternalSenders $true`), real-time scanning of suspicious links and links to files (`ScanUrls $true`), delivery after scanning (`DeliverMessageAfterScan $true`), URLs rewritten (`DisableUrlRewrite $false`); - Teams (`EnableSafeLinksForTeams $true`) and Office apps (`EnableSafeLinksForOffice $true`); - clicks tracked (`TrackClicks $true`) and no click-through to the original URL (`AllowClickThrough $false`); - a short, reviewed **Do not rewrite the following URLs** list. No mail flow rule skips Safe Links (rules that set the `X-MS-Exchange-Organization-SkipSafeLinksProcessing` header). rationale: | Attackers send clean links and arm them after delivery, or point to file downloads. Time-of-click checks catch both, internal scanning catches phishing sent from a compromised internal account, and blocking click-through stops users from overriding the warning. Click tracking tells the SOC who clicked a link found to be malicious later. impact: | Users see rewritten links in email. Messages with links can be delayed while URLs are scanned. Click data is kept for investigations; inform users and staff representatives as required. audit: manual: | 1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader. 2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Safe Links** and check that the Standard (or Strict) preset or a custom policy covers all recipients with the values above. 3. In Exchange Online PowerShell (read-only): ```powershell Get-SafeLinksPolicy | Format-List Name, EnableSafeLinksForEmail, EnableForInternalSenders, ScanUrls, DeliverMessageAfterScan, DisableUrlRewrite, EnableSafeLinksForTeams, EnableSafeLinksForOffice, TrackClicks, AllowClickThrough, DoNotRewriteUrls Get-SafeLinksRule | Format-List Name, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except* Get-TransportRule | Where-Object { $_.SetHeaderName -like '*SkipSafeLinksProcessing*' } | Format-Table Name, State ``` 4. Fail if some recipients are only covered by the Built-in protection preset or by a policy that misses one of the values above, or if a mail flow rule skips Safe Links. remediation: manual: | 1. Prefer the preset: apply the Standard preset to all recipients (CB-M365-MAIL-019). 2. For a custom policy, in **Safe Links**, edit the policy (Security Administrator): **URL & click protection settings** with every option above selected, **Let users click through to the original URL** cleared, and users and domains set to all accepted domains. 3. PowerShell equivalent: ```powershell Set-SafeLinksPolicy -Identity "" -EnableSafeLinksForEmail $true -EnableForInternalSenders $true -ScanUrls $true ` -DeliverMessageAfterScan $true -DisableUrlRewrite $false -EnableSafeLinksForTeams $true -EnableSafeLinksForOffice $true ` -TrackClicks $true -AllowClickThrough $false ``` 4. Remove or rewrite the mail flow rules that skip Safe Links. rollback: | Restore the previous values on the custom policy. references: - title: Safe Links in Microsoft Defender for Office 365 url: https://learn.microsoft.com/defender-office-365/safe-links-about publisher: Microsoft kind: vendor-doc accessed: 2026-10-24 - title: Set up Safe Links policies in Microsoft Defender for Office 365 url: https://learn.microsoft.com/defender-office-365/safe-links-policies-configure publisher: Microsoft kind: vendor-doc accessed: 2026-10-24 - title: Recommended settings for EOP and Microsoft Defender for Office 365 security url: https://learn.microsoft.com/defender-office-365/recommended-settings-for-eop-and-office365 publisher: Microsoft kind: vendor-doc accessed: 2026-10-24 - title: CISA SCuBA Microsoft 365 security suite baseline url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md publisher: CISA kind: standard accessed: 2026-10-24 - title: ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-105, 113, 156, 179, 226, 236, 237, 238, 189-2) url: https://github.com/cammurray/orca publisher: Microsoft (community project) kind: tool accessed: 2026-10-24 mappings: - framework: cis-m365 framework_version: "7.0.0" id: "2.1.1" relation: equivalent - framework: cisa-scuba-m365 framework_version: "2.0.0" id: MS.SECURITYSUITE.7.1v1 relation: equivalent - framework: cisa-scuba-m365 framework_version: "2.0.0" id: MS.SECURITYSUITE.7.2v1 relation: equivalent - framework: cisa-scuba-m365 framework_version: "2.0.0" id: MS.SECURITYSUITE.7.3v1 relation: equivalent - framework: nist-800-53r5 framework_version: "5.1.1" id: SI-3 relation: related - framework: nist-800-53r5 framework_version: "5.1.1" id: SI-8 relation: related threats: - framework: mitre-attack id: T1566.002 - framework: mitre-attack id: T1204.001 related_controls: - id: CB-M365-MAIL-019 type: related authors: - name: Alice github: Sn0wAlice introduced_in: 0.1.0 created: 2026-10-24 updated: 2026-10-24