Configure Safe Links and Safe Attachments in Defender for Office 365

Standard Exchange Online Protection scans mail at delivery time — but attackers routinely weaponize URLs after delivery, sending a clean link that starts redirecting to a phishing page hours later. Attachment-based malware similarly evades signature scanning with fresh, never-seen-before payloads. Defender for Office 365 addresses both gaps: Safe Links re-checks URLs at the moment of click, and Safe Attachments detonates files in a sandbox before they reach the mailbox.

How Safe Links works

• URLs in inbound mail are rewritten to route through Microsoft's checking infrastructure. When a user clicks — whether five minutes or five days after delivery — the destination is evaluated at that moment.
• Malicious destinations show a block page; unknown URLs can be scanned in real time before the user is allowed through.
• Protection extends beyond email: Safe Links also covers Teams messages and Office documents when enabled in the policy.
• Critical setting: disable Let users click through to the original URL. If users can bypass the warning page, the control becomes advisory.

How Safe Attachments works

• Attachments are opened and executed in an isolated sandbox environment; behavior — not signatures — determines the verdict. This catches novel malware that no antivirus definition knows yet.
• Recommended delivery mode is Dynamic Delivery: the message body arrives immediately with a placeholder attachment, and the real file is attached once scanning completes. This removes the delivery-delay complaint almost entirely.
• Enable Safe Attachments for SharePoint, OneDrive, and Teams as well — email is not the only way malicious files enter the tenant.

Deployment steps

• The fastest correct path is the built-in Standard preset security policy, which applies Microsoft's recommended Safe Links and Safe Attachments settings to all users. Use the Strict preset for high-risk groups such as executives and finance.
• If you prefer custom policies, create them in the Defender portal under Email & collaboration > Policies & rules > Threat policies, and verify no user is left uncovered — preset policies win over custom ones in precedence, so understand the order of evaluation.
• Check licensing: Safe Links and Safe Attachments require Defender for Office 365 Plan 1, included in Microsoft 365 Business Premium and E5, or available as an add-on.
• Validate the configuration with Microsoft's configuration analyzer, which compares your policies against Standard and Strict baselines and flags drift.

Operational notes

• Rewritten URLs (*.safelinks.protection.outlook.com) confuse some users and break naive link-copying workflows; native link rendering in modern Outlook clients displays the original URL to reduce this friction.
• Review detections in Threat Explorer regularly — post-delivery detections (ZAP events) tell you which threats arrived clean and turned malicious later, which is exactly the class of attack these features exist to stop.
• These controls reduce, but do not eliminate, phishing risk. Pair them with the Conditional Access and MFA baseline, and with user reporting via the built-in Report Phishing button.

For most organizations this is under an hour of configuration work with the preset policies — one of the best effort-to-impact ratios available in Microsoft 365 security.