Defender for Office 365 Safe Links and Attachments
Overview
Safe Attachments detonates files; Safe Links rewrites URLs. Together they sharply reduce phishing impact.
Policy tiers
Build at least two: Standard (most users) and Strict (finance, admins, executives).
Exceptions
Document time-boxed allow rules for marketing/newsletters after security review.
Operational review
Weekly alert triage for false positives; monthly executive-friendly stat: blocked threats vs attempts.
Integration
Ensure transport rules and journaling don’t bypass scanning unintentionally.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...