Best Practices for Safe Links and Safe Attachments

In this video, I cover some of the best practices when creating Safe Links and Safe Attachments policies in Defender for Office 365.

[@lostmatt]

Yes an end-to end setup would be great!

[@t-minus365]

coming soon!

[@MattSaundersMCP]

Love your work Nick, keep it up

[@t-minus365]

Appreciate the support!

[@byron_glover]

Thanks for the demo! Just trying to understand when you enable the "Global Setting" for Teams, Sharepoint, etc, does that impact all users straight away? Or do you still have to apply the policy first as well?

[@JudgeDrD]

would be nice to see a generic bypass list for URL rewriting, to not rewrite meeting links like zoom, and other popular services

[@polonia66]

Hi, thanks again for videos. I have an question if user will recived a word document with malicious link - it will be scanned by safe link before sending or when user will try to open it? I am thinking is there any option to receive alert if user visit malicious website or even tied to? Great channel I am going to watch all your videos!

[@pjrouse]

In my experience I avoid configuring dynamic delivery for my clients. It often confuses users (regardless of how well it’s communicated) and frustrates them when they can see an email with an attachment they can’t access. It also effectively delivers the email twice (once before the scan completes and again after) which is annoying for mobile email users who get multiple notifications for the same email.

[@t-minus365]

Hey thanks for that feedback! That is good to know. What option do you like to use in lieu of that?

[@pjrouse]

@@t-minus365 I typically use Block as the action - prevents anything nasty getting to the user and doesnt tease them with an attachment they cant open :)

[@blueteaming]

Perfect example. We didn't choose Dynamic delivery for the same reason and moreover, it is in preview so we cannot log a case with Microsoft if there are any issues.

[@miked.4786]

I've looked into multiple M365 Tenants and in the Roadmap and didn't see anything about that Quarantine policy drop-down choice that you displayed in the Safe Attachments policy that you showed. Is it being rolled out ?

[@t-minus365]

Interesting, i do not believe this is a preview feature as I am not in any early access program (I checked multiple tenants as well). What licensing do you have and what portal are you using to create the policy? (Security and Compliance center vs Microsoft Defender Security Center)

[@miked.4786]

I just saw Roadmap ID 62450 that might be related to this that is in development and should be launched this month. We'll see, thanks for replying !

[@blueteaming]

@@t-minus365 I didn't see it in my environment as well. I'm using the latest portal and we are having E5 security.