> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/defender/safe-links.md). # Safe Links Safe Links is the Defender for Office 365 policy type that protects your clients' users against malicious URLs — in email, in Teams messages, and inside Office documents. Instead of trusting a link at the moment it's delivered, Safe Links rewrites URLs so that every click is routed through Microsoft's scanning service first and checked again in real time, at the moment the user actually clicks — not just when the message first arrives. This closes the "weaponized after delivery" gap, where a link is clean when it lands in the inbox but the attacker swaps it out for a malicious page hours or days later. {% hint style="info" %} Safe Links requires **Defender for Office 365 Plan 1** at minimum (included with Microsoft 365 Business Premium, or as an add-on to Office 365 E3; Plan 2 comes with Microsoft 365 E5). See the main [Defender](/modules/secure/defender.md) page for how templates, baselines, and deployment work generally — this page covers Safe Links specifically. {% endhint %} ## What you can configure A Safe Links template exposes these settings, grouped the way they appear in Augmentt: **Protection settings** * **Email** — turn Safe Links protection on or off for email overall (`EnableSafeLinksForEmail`). When on, two sub-settings apply: * **Apply Safe Links to internal senders** (`EnableForInternalSenders`) — extend protection to links in mail sent between users inside the same tenant, not just external mail. * **Apply URL scanning** (`ScanUrls`) — perform real-time scanning of the destination page at click time. When this is on, you can also set: * **Wait for scan to complete before delivering the message** (`DeliverMessageAfterScan`) — hold the message until the initial scan finishes, rather than delivering immediately and relying only on click-time protection. * **Do not rewrite URLs** (`DisableUrlRewrite`) — an override that stops Safe Links from rewriting links at all (URLs are still checked, but the display/click-through link isn't replaced). * **Do not rewrite the following URLs** (`DoNotRewriteUrls`) — an exclusion list of specific URLs or domains to leave untouched (for trusted internal tools, sign-in portals, etc. that break when rewritten). * **Teams** — turn Safe Links protection on for links shared in Microsoft Teams chats and channels (`EnableSafeLinksForTeams`). * **Office 365 apps** — turn Safe Links protection on for links inside Word, Excel, and PowerPoint documents opened via Office apps, Office on the web, or Office mobile (`EnableSafeLinksForOffice`). * **Track user clicks** (`TrackClicks`) — log when a user clicks a Safe Links–protected URL, powering reporting on who clicked what. When enabled, two further options appear: * **Let users click through to the original URL** (`AllowClickThrough`) — even after a warning page, allow the user to proceed anyway. Leaving this off is the safer, more restrictive setting. * **Display the organization branding on notification and warning pages** (`EnableOrganizationBranding`) — show your client's own logo/branding on the interstitial warning page instead of a generic Microsoft one. **Notification settings** * **Use custom notification text** — replace Microsoft's default block/warning page copy with your own (`CustomNotificationText`), optionally combined with Microsoft Translator to localize it automatically for the recipient (`UseTranslatedNotificationText` / `LocalizedNotificationTextList`). ## Augmentt's default template Augmentt ships one out-of-the-box Safe Links template: ### Safe links - Secure Score recommendations | Setting | Value | | ------------------------------------------- | -------------------------- | | Email protection | On | | Apply to internal senders | On | | URL scanning | On | | Wait for scan before delivery | On | | Do not rewrite URLs | Off (URLs *are* rewritten) | | URL exclusion list | None | | Teams protection | On | | Office 365 apps protection | On | | Track user clicks | On | | Allow click-through | Off | | Organization branding on notification pages | Off | | Custom notification text | None (Microsoft default) | This is a fully-on, no-exceptions configuration — every scanning surface (email, Teams, Office apps) is enabled, internal mail isn't exempted, and users aren't allowed to click through past a warning. It matches Microsoft's own **Standard** *and* **Strict** preset security policy values for Safe Links — Microsoft doesn't actually vary Safe Links settings between its two preset tiers, so there's no "more aggressive" variant to offer here the way there is for anti-phishing. **Resolves posture check(s):** * **MDOSAFELINKSFOREMAIL** — the Secure-Score-sourced check for Safe Links being enabled for email. Mapped in Augmentt's compliance library to CMMC Level 1 (SI.L1-b.1.xiii — Malicious Code Protection), CMMC Level 2 (SI.L2-3.14.2 — Scan Email URLs), HIPAA §164.308(a)(5)(ii)(B) (Protection from Malicious Software), and NIST CSF 2.0 DE.CM-09 (malicious activity monitoring). * **CIS\_M365 §2.1.1 — "Ensure Safe Links for Office Applications is Enabled"** (both the CIS Microsoft 365 Foundations Benchmark v6 and v7, Level 2). This one specifically checks the Office-apps toggle (`EnableSafeLinksForOffice`), which the default template turns on. ## Deploying and troubleshooting Deployment mechanics (policy-then-rule creation, admin role requirements, Secure Score's 24–72 hour propagation delay) are the same for every Defender policy type — see the main [Defender](/modules/secure/defender.md) page's **Policies** and **Troubleshooting** sections. Safe Links–specific things to know: * Because Safe Links writes affect Exchange Online mail flow, the connection needs at least **Exchange Administrator** on the Microsoft 365 integration to deploy. * A policy scoped to a pilot group only will still show as non-compliant in Secure Score, since Secure Score expects org-wide coverage. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/defender/safe-links.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.