Safe Links Policy (Octiga)
Microsoft Defender for Office 365 Safe Links scans URLs in email messages and Office documents in real time. This policy creates a dedicated Safe Links policy named “Octiga Safe Links Policy” and controls which users, groups, and domains are protected, along with how malicious links are handled.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Policy name | The name of the Safe Links policy. This policy is named “Octiga Safe Links Policy” and is applied to the specified users, groups, and domains. Learn more |
| Email link scanning enabled | Enables Safe Links scanning for email messages. When enabled, URLs in emails are checked against a list of known malicious links. Learn more |
| Internal sender scanning enabled | Applies Safe Links scanning to email messages sent within the organisation. Learn more |
| Real-time URL scanning enabled | Enables real-time URL scanning for suspicious links and links that point to files before the message is delivered. Learn more |
| Wait for scan before delivery | When enabled, the message is held until URL scanning is complete before being delivered to the recipient. Learn more |
| URLs excluded from rewriting | A list of URLs that Safe Links should not rewrite in email. Safe Links checks are still performed via the Safe Links API only. Learn more |
| URL rewriting disabled | Do not rewrite URLs. Do checks via Safe Links API only. Learn more |
| Teams link scanning enabled | Enables Safe Links scanning for URLs in Microsoft Teams messages. URLs are not rewritten but are checked when clicked. Learn more |
6 more settings
| Setting | What it does |
|---|---|
| Office apps scanning enabled | Enables Safe Links scanning for URLs in Microsoft Office apps. URLs are not rewritten but are checked when clicked. Learn more |
| Track user clicks | Records user clicks on URLs that are checked by Safe Links for reporting and investigation. Learn more |
| Allow click-through | When enabled, users can click through to the original URL even if Safe Links has flagged it as potentially malicious. Learn more |
| Show organisation branding | Displays the organisation’s branding on Safe Links notification and warning pages shown to users. Learn more |
| Automatic translation enabled | When enabled, Microsoft Translator is used to automatically localise the custom notification text. Learn more |
| Custom notification text | The custom notification text shown to users when Safe Links blocks a URL. Learn more |
Configure it
This baseline turns on Safe Links, which scans URLs in email and Office in real time.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Turn on scanning everywhere it can run.
Set Email link scanning enabled, Internal sender scanning enabled, Teams link scanning enabled, Office apps scanning enabled and Real-time URL scanning enabled all on, so a link is checked wherever someone might click it, not only in mail from outside.
-
Wait for the scan before delivering.
Set Wait for scan before delivery on, so a message with links is held briefly until scanning finishes rather than delivered and checked only on click. This can add a short delay to messages with links.
-
Leave rewriting, tracking and branding on.
Leave URL rewriting disabled off and Track user clicks on, so links keep going through Safe Links’ redirect. Leave Allow click-through and Show organisation branding on, so a flagged link shows a warning page branded as your tenant’s, rather than blocking outright.
-
Check its priority against other policies.
Octiga creates its own Octiga Safe Links Policy. Like Safe Attachments, it applies behind any Strict or Standard preset assigned to the same recipients (see Preset EOP Policy (Standard) and Preset EOP Policy (Strict)).
-
Save.
Turn on Auto-remediation if you want Octiga to reapply this whenever it’s changed (see Remediation).
Check it worked
Passing means the Octiga Safe Links Policy exists, is on, and matches these settings. Check it in the Microsoft Defender portal, under Email & collaboration → Policies & rules → Threat policies → Safe Links. Users see a warning page on a flagged link, and a short delivery delay on messages containing links while they’re scanned.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.