Safe Attachments and Safe Links in Defender for Office 365: what really weakens protection
Safe Attachments and Safe Links are among the most useful features of Defender for Office 365. Yet in our audits they are often enabled on paper and bypassed in practice: accumulated exclusions, custom policies weaker than the built-in protection, URL lists that are never rewritten. Here is how to make sense of it.
Two complementary features
Safe Attachments opens attachments in an analysis environment before delivering them, to catch malicious behaviour that signature-based engines miss. Safe Links checks URLs at the time of click, not just on arrival: a link that is harmless at 9 am can point to a phishing page by 11 am.
Both features require Defender for Office 365 (Plan 1 or Plan 2, or a bundle that includes them). Licence names and exact scope change over time; check what is actually assigned in your tenant before concluding that a feature is available.
Preset, custom and built-in protection
Three levels coexist and are applied in a specific order of precedence:
- preset security policies, Strict then Standard, whose settings are maintained by Microsoft;
- custom policies, in the priority order set by the administrator;
- built-in protection, which by default covers every recipient not targeted by another policy.
A recipient only gets one policy per protection type: the first one that applies. That is where a common trap lies. A custom policy created years ago with weaker settings and scoped to "all users in the domain" takes precedence over built-in protection. The tenant looks protected, but with degraded settings.
Our default recommendation: apply the Standard preset policy to all users and Strict to the most exposed accounts (executives, finance, administrators), and only keep custom policies for documented needs.
Safe Attachments: delivery choices
For email, the Safe Attachments action shapes the user experience:
- Block: the message is held during analysis, then quarantined if malicious;
- Dynamic Delivery: the message body is delivered immediately with a placeholder instead of the attachment, which is reattached once the analysis is complete;
- Monitor: the message is delivered and the detection is only logged;
- Off: no analysis at all.
Dynamic Delivery addresses users' main objection, the delivery delay. It only works for mailboxes hosted in Exchange Online. Monitor mode, often chosen for a test and then forgotten, effectively lets malicious attachments through.
SharePoint, OneDrive and Teams. Safe Attachments for these services is controlled by a global setting, separate from the email policies. Check that it is enabled and that users cannot download a file detected as malicious. Safe Documents, which protects files opened in Protected View in Office apps, requires a higher licence.
Safe Links: settings that matter
In a Safe Links policy, several options make a real difference:
- coverage of email, Teams and Office apps, which are configured separately;
- waiting for URL scanning to complete before delivering the message;
- applying the policy to internal messages, useful when a compromised internal account is used as a relay;
- letting users click through the warning to the original URL, which is best disabled;
- click tracking, essential to know who clicked during a campaign.
Exclusions that hollow out protection
The most common weakness we find is not a disabled feature but an accumulation of exceptions:
- the "do not rewrite the following URLs" list, filled in request after request, sometimes with file-sharing or form domains that attackers use heavily;
- recipients or groups excluded from policies, often executive accounts "so as not to bother them";
- mail flow rules that add bypass headers for simulation tools or third-party gateways instead of using advanced delivery;
- custom policies scoped to a single accepted domain, leaving the others on minimal protection.
Every exception needs a written reason and a review date. Excluding executives is almost never justifiable: they are precisely the priority targets.
What an audit checks
- The Defender for Office 365 licences actually assigned and the population covered.
- Use of preset policies and the effective priority order of custom policies.
- The configured Safe Attachments action, and no Monitor or Off mode outside testing.
- Safe Attachments enabled for SharePoint, OneDrive and Teams.
- Safe Links coverage of Teams and Office apps, and the click-through option.
- The contents of "do not rewrite" lists and excluded recipients.
- Mail flow rules that bypass scanning.