3.1MS-102Intermediate
Est: ~15 mins•Verified: 2026-08

Defender for Office 365: Anti-Phishing & Safe Links

Implement advanced email threat protection using Microsoft Defender for Office 365: Safe Links, Safe Attachments Dynamic Delivery, and impersonation defense.

Tags:#Defender for Office 365#Safe Links#Safe Attachments#Phishing#Security#MS-102
01

Overview

Microsoft Defender for Office 365 (MDO) provides cloud-native perimeter and post-delivery email security defending organizations against sophisticated phishing, credential harvesting, business email compromise (BEC), zero-day malware, and malicious URLs.

Its flagship defense pillars include:

  1. Safe Attachments: Sandboxes all inbound email attachments in an isolated Microsoft virtual environment, detonate-testing executable payloads before releasing to user mailboxes. Features Dynamic Delivery to eliminate email latency.
  2. Safe Links: Provides real-time Time-of-Click URL verification. Re-writes inbound links so that if a clean URL turns malicious hours after email delivery, users are intercepted and blocked when clicking.
  3. Anti-Phishing & Impersonation Protection: Uses machine learning to detect user impersonation (CEO fraud) and domain spoofing.

---

02

When to Use: Policy Configuration Baseline

Threat VectorMDO Protection FeatureRecommended Production Setting
Unknown Malware in AttachmentsSafe Attachments PolicyDynamic Delivery (Delivers email text immediately while scanning attachment in background).
Malicious Links & Time-Delayed URLsSafe Links PolicyOn (Real-time URL scanning, do not rewrite links internally, do not let users click through).
Executive VIP ImpersonationAnti-Phishing PolicyTargeted User Protection (Protect top 100 VIP executives from display name spoofing).
Domain SpoofingAnti-Phishing Mailbox IntelligenceEnabled (Quarantine impersonated messages immediately).

---

03

Prerequisites

Licensing:

  • Microsoft 365 E5, Office 365 E5, Microsoft 365 Business Premium, or Defender for Office 365 Plan 1 / Plan 2 add-on.

Administrative Roles:

  • Security Administrator or Exchange Administrator in Microsoft Defender XDR portal (security.microsoft.com).

---

04

Portal Path

TEXT
Microsoft Defender XDR Portal (https://security.microsoft.com)
└── Email & collaboration
    └── Policies & rules
        └── Threat policies
            ├── Safe Attachments
            ├── Safe Links
            └── Anti-phishing

---

05

Step-by-Step Implementation

Step 1: Configure Safe Attachments with Dynamic Delivery

  1. Navigate to Defender Portal (security.microsoft.com) > Email & collaboration > Policies & rules > Threat policies > Safe Attachments.
  2. Click Create. Name: MDO-SafeAttachments-Default.
  3. Under Users, groups, and domains: Target your primary domain (e.g., contoso.com).
  4. Under Safe Attachments detection response, select:
  • Dynamic Delivery (Preview message with attachment placeholder).
  • Redirect messages with detected attachments: Yes > Enter security admin quarantine mailbox.
  1. Save policy. (Users receive the email body immediately while an attachment preview animation displays until the cloud sandbox finishes detonation).

Step 2: Configure Safe Links (Time-of-Click URL Protection)

  1. In Threat policies, select Safe Links > Click Create.
  2. Name: MDO-SafeLinks-Enterprise.
  3. Under URL & click protection settings:
  • On: Safe Links checks a list of known, malicious links when users click links in email.
  • Apply Safe Links to email messages sent within the organization: Yes.
  • Apply real-time URL scanning for suspicious links and links that point to files: Yes.
  • Wait for URL scanning to complete before delivering the message: Yes.
  • Apply Safe Links to Microsoft Teams: Yes.
  • Do not let users click through to the original URL: Checked (Strict enforcement).
  1. Assign to all domains.

Step 3: Configure VIP Impersonation Protection

  1. In Threat policies, select Anti-phishing > Edit or create policy.
  2. Under Phishing threshold & sensitivity:
  • Enable Protect specified users: Add executive email addresses and real display names.
  • Enable Protect specified domains: Include your owned custom domains.
  • Action: If impersonation is detected, Quarantine the message.

---

06

PowerShell Automation

Connect to Exchange Online PowerShell:

PowerShell
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Inspect active Safe Links policy settings
Get-SafeLinksPolicy | Select-Object Name, IsEnabled, ScanUrls, EnableSafeLinksForTeams, AllowClickThrough

# Inspect active Safe Attachments policy settings
Get-SafeAttachmentPolicy | Select-Object Name, Action, Redirect, RedirectAddress

---

07

Microsoft Graph Automation

Query Email Threat Detections via Microsoft Graph Security API:

PowerShell
Connect-MgGraph -Scopes "SecurityEvents.Read.All"

# List recent high-severity email security alerts
Get-MgSecurityAlert_v2 -Filter "serviceSource eq 'microsoftDefenderForOffice365'" -Top 10 | 
    Select-Object id, title, severity, category, createdDateTime

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Inbound test emails with attachments display a temporary "Scanning Attachment" placeholder.
Hovering over URLs in Outlook shows the URL is wrapped with https://*.safelinks.protection.outlook.com.
Clicking a simulated phishing link in Teams displays the red Microsoft block page.
Users cannot bypass red warning screens when "Do not let users click through" is enabled.
Quarantined emails appear in the admin Review > Quarantine portal.
09

Diagnostic Logs & Channels

Tool / LocationPathPurpose
Threat ExplorerDefender Portal > Email & collaboration > ExplorerInteractive visual hunting tool tracking all emails, URLs, malware hashes, and clicks.
URL Click Protection ReportReports > Email & collaboration > URL protection reportAudits user click activity: Clicks allowed, blocked, clicked through, or bypassed.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Email delivery delayed by 5+ minutesSafe Attachments was set to Block instead of Dynamic Delivery.Switch policy action to Dynamic Delivery to eliminate user delivery delay.
False positive blocks legitimate partner linkURL reputation engine flagged newly registered domain or redirection chain.Add the URL to Tenant Allow/Block Lists under URLs as an Allow indicator.
Safe Links not protecting Teams chatApply Safe Links to Microsoft Teams checkbox was not enabled in policy.Open Safe Links policy properties and check the Teams protection checkbox.

---

11

Production Best Practices

Production Best Practice

Use Preset Security Policies (Standard vs Strict):

Instead of manually tuning dozens of individual anti-spam, anti-malware, and phishing policies, utilize Microsoft's Preset Security Policies (Strict for VIPs and IT admins; Standard for broad users). Microsoft maintains and updates optimal threshold configurations automatically.

---

12

MS-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Dynamic Delivery: Dynamic Delivery delivers the email text immediately while placing a placeholder icon on the attachment while scanning in the cloud sandbox.
  2. Time-of-Click Advantage: Safe Links protects against attacks where a legitimate website is compromised after the email has already landed in the user's inbox.
  3. Priority Order: Custom policies always take precedence over default policies; highest priority number evaluates first.

---

13

Official Documentation

PREVIOUS TOPIC2.4 Access Reviews, Entitlement Management & Privileged Access GroupsNEXT TOPIC3.2 Defender for Cloud Apps: Shadow IT & Session Control