# Safe Links Policy (Octiga) > Microsoft Defender for Office 365 Safe Links scans URLs in email messages and Office documents in real time. Microsoft Defender for Office 365 Safe Links scans URLs in email messages and Office documents in real time. This policy creates a dedicated Safe Links policy named "Octiga Safe Links Policy" and controls which users, groups, and domains are protected, along with how malicious links are handled. ## Settings this baseline controls | Setting | What it does | | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Policy name | The name of the Safe Links policy. This policy is named "Octiga Safe Links Policy" and is applied to the specified users, groups, and domains. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Email link scanning enabled | Enables Safe Links scanning for email messages. When enabled, URLs in emails are checked against a list of known malicious links. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Internal sender scanning enabled | Applies Safe Links scanning to email messages sent within the organisation. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Real-time URL scanning enabled | Enables real-time URL scanning for suspicious links and links that point to files before the message is delivered. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Wait for scan before delivery | When enabled, the message is held until URL scanning is complete before being delivered to the recipient. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | URLs excluded from rewriting | A list of URLs that Safe Links should not rewrite in email. Safe Links checks are still performed via the Safe Links API only. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | URL rewriting disabled | Do not rewrite URLs. Do checks via Safe Links API only. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Teams link scanning enabled | Enables Safe Links scanning for URLs in Microsoft Teams messages. URLs are not rewritten but are checked when clicked. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | **6 more settings** | Setting | What it does | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Office apps scanning enabled | Enables Safe Links scanning for URLs in Microsoft Office apps. URLs are not rewritten but are checked when clicked. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Track user clicks | Records user clicks on URLs that are checked by Safe Links for reporting and investigation. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Allow click-through | When enabled, users can click through to the original URL even if Safe Links has flagged it as potentially malicious. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Show organisation branding | Displays the organisation's branding on Safe Links notification and warning pages shown to users. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Automatic translation enabled | When enabled, Microsoft Translator is used to automatically localise the custom notification text. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | | Custom notification text | The custom notification text shown to users when Safe Links blocks a URL. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it This baseline turns on Safe Links, which scans URLs in email and Office in real time. 1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. **Turn on scanning everywhere it can run.** Set **Email link scanning enabled**, **Internal sender scanning enabled**, **Teams link scanning enabled**, **Office apps scanning enabled** and **Real-time URL scanning enabled** all on, so a link is checked wherever someone might click it, not only in mail from outside. 3. **Wait for the scan before delivering.** Set **Wait for scan before delivery** on, so a message with links is held briefly until scanning finishes rather than delivered and checked only on click. This can add a short delay to messages with links. 4. **Leave rewriting, tracking and branding on.** Leave **URL rewriting disabled** off and **Track user clicks** on, so links keep going through Safe Links' redirect. Leave **Allow click-through** and **Show organisation branding** on, so a flagged link shows a warning page branded as your tenant's, rather than blocking outright. 5. **Check its priority against other policies.** Octiga creates its own **Octiga Safe Links Policy**. Like Safe Attachments, it applies behind any Strict or Standard preset assigned to the same recipients (see [Preset EOP Policy (Standard)](https://docs.octiga.io/baselines/email-security/preset-eop-protection-policy-rule-standard/) and [Preset EOP Policy (Strict)](https://docs.octiga.io/baselines/email-security/preset-eop-protection-policy-rule-strict/)). 6. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply this whenever it's changed (see [Remediation](https://docs.octiga.io/baselines/remediation/)). > **Licence: Defender for Office 365:** Safe Links needs Defender for Office 365. Without it, this baseline is skipped rather than reported as a deviation (see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/)). ## Check it worked Passing means the **Octiga Safe Links Policy** exists, is on, and matches these settings. Check it in the Microsoft Defender portal, under **Email & collaboration → Policies & rules → Threat policies → Safe Links**. Users see a warning page on a flagged link, and a short delivery delay on messages containing links while they're scanned. ## Standards this addresses ### CIS - **M365 2.1.1** — CIS M365 Foundations Benchmark 2.1.1 - **v8 9.7** — CIS Controls v8 Safeguard 9.7 ### NIST - **PR.PT-3** — NIST CSF 2.0 PR.PT-3 - **SC-7** — NIST SP 800-53 SC-7 - **SI-4** — NIST SP 800-53 SI-4 ### ISO 27001 - **A.8.7** — ISO/IEC 27001:2022 Annex A.8.7 - **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)