What this check looks at
Checks for a Safe Links policy that applies to everyone and has the settings CIS lists: email, Teams and Office apps covered, clicks tracked, no click-through, real-time scanning, internal senders included and delivery held until scanning finishes.
Safe Links, part of Defender for Office 365, rewrites links in email and checks each one at the moment it is clicked, in Outlook, Teams and Office apps, against Microsoft’s threat intelligence; if the site is known to be malicious it shows a warning page instead. The Built-in protection policy gives licensed users basic Safe Links, but it leaves out messages between internal senders, and the strongest settings only come from a policy you create or from the preset policies.
The check looks for a Safe Links policy that is on and applies to everyone (no user or group conditions, every custom domain included) with all the settings CIS 2.1.1 lists: on for email, Teams and Office apps; clicks tracked; click-through not allowed; real-time URL scanning; internal senders included; delivery held until scanning completes; and URL rewriting not switched off. It fails when no policy is on, when none applies to everyone, or when the policy for everyone misses any of those settings, which it names. It is not applicable without Defender for Office 365.
Attackers send links that are clean on delivery and switch to a credential-harvesting page an hour later, or hide them behind legitimate file-sharing and survey sites. Without time-of-click checking, the link is judged only once, when the message arrives. Allowing click-through lets people dismiss the warning, and leaving out internal senders means a compromised colleague’s phishing link is never checked.
Why it matters
Phishing links are often harmless when the email arrives and switched to malicious later. Safe Links checks every link when it is clicked, in email, Teams and documents, and stops the click when the site has turned bad.
A common pattern in UK small business compromises: a supplier’s mailbox is taken over and sends a remittance advice with a link to a fake Microsoft sign-in page that was harmless when the message was delivered. With Safe Links checking at click time the user sees a block page; without it, they enter their password and MFA code into an adversary-in-the-middle kit and the attacker takes the session.
One such click costs as much as any mailbox compromise: invoice fraud, a mailbox full of personal data to assess under UK GDPR, and days of investigation. Safe Links is included in Business Premium and E5, so the protection is already paid for.
CIS Microsoft 365 Foundations Benchmark 2.1.1 asks for Safe Links for email, Teams and Office apps with these settings. ISO 27001 A.8.23 (web filtering) and A.8.7 (protection against malware), CIS Controls v8 9.7, NIST CSF 2.0 DE.CM-09 and NCSC CAF B4.b all call for it, and the Cyber Essentials Plus malware protection test checks how email and web content is handled.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Safe Links
Before you start
- Needs Defender for Office 365 Plan 1 or higher. Tell users links may look different (rewritten) and that clicks are checked.
Step by step
- Check the licence and the existing policies. Safe Links needs Defender for Office 365 Plan 1 or Plan 2 (Business Premium and E5 include it). In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Safe Links and note the existing policies, who they apply to and their priority. If one already applies to everyone, correct it (see the PowerShell step) rather than adding another.
- Create the policy and set who it applies to. Select Create and name the policy Safe Links - everyone. On Users and domains, under Domains add every accepted domain (each custom domain and the onmicrosoft.com domain) and leave Users and Groups empty, so the policy applies to everyone. Add no exclusions without a documented reason.
- Set the URL protection settings. On URL & click protection settings, under Email turn Safe Links on and tick the options to apply Safe Links to messages sent within the organisation, to apply real-time URL scanning for suspicious links and links that point to files, and to wait for URL scanning to complete before delivering the message. Leave Do not rewrite URLs, do checks via Safe Links API only unticked. Turn Safe Links on for Microsoft Teams and for Office 365 Apps.
- Set click protection and finish. Under Click protection settings tick Track user clicks and untick Let users click through to the original URL. Choose the notification page, select Next, review and select Submit. Then select the new policy in the list and use Increase priority until it is priority 0, above any other custom Safe Links policy.
- Or create or fix it in Exchange Online PowerShell. Run New-SafeLinksPolicy -Name "Safe Links - everyone" -EnableSafeLinksForEmail $true -EnableSafeLinksForTeams $true -EnableSafeLinksForOffice $true -EnableForInternalSenders $true -ScanUrls $true -DeliverMessageAfterScan $true -TrackClicks $true -AllowClickThrough $false -DisableUrlRewrite $false, then New-SafeLinksRule -Name "Safe Links - everyone" -SafeLinksPolicy "Safe Links - everyone" -RecipientDomainIs (Get-AcceptedDomain).Name -Priority 0. To correct an existing policy, run Set-SafeLinksPolicy -Identity "<name>" with the same settings.
- Tell users what changes. Let people know that links in email may look different (rewritten to a safelinks.protection.outlook.com address), that some messages with links arrive a minute or two later while scanning finishes, and that a warning page means the site was blocked on purpose.
- Confirm the policy applies to everyone. Run Get-SafeLinksPolicy -Identity "Safe Links - everyone" | Format-List EnableSafeLinksFor*, EnableForInternalSenders, ScanUrls, DeliverMessageAfterScan, TrackClicks, AllowClickThrough, DisableUrlRewrite and Get-SafeLinksRule | Format-Table Name, State, Priority, RecipientDomainIs. Send a message with a link from an external mailbox and check the link is rewritten. The next assessment passes.
What users will notice
Links in email, Teams and Office documents are checked when clicked; malicious sites are blocked with a warning page. Messages with links may arrive a little later while scanning finishes.
How to confirm it worked
Get-SafeLinksPolicy shows the policy with the settings in the finding, and Get-SafeLinksRule shows it enabled for every accepted domain at the highest priority.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.4.1 Personnel are protected against phishing attacks |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.23 Web filteringA.8.7 Protection against malware |
| CIS M365 | 2.1.1 Ensure Safe Links for Office Applications is enabled |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3) |
| NIST CSF 2.0 | DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set up Safe Links policies (Microsoft Learn)