Safe Links and Safe Attachments in Microsoft 365: what an SME should enable

What Safe Links and Safe Attachments are and are not

Safe Links sits in Microsoft Defender for Office 365 mail and Office protection. When someone clicks a URL in mail (and often in Teams or Office documents, depending on policy), that link is checked — sometimes by rewriting to a Microsoft proxy, sometimes with click-time checks. The goal: block phishing and malware URLs even if they turn malicious after delivery, not only at the moment of arrival.

Safe Attachments sends suspicious or unknown attachments through a detonation environment first: the file is opened in an isolated sandbox and assessed before (or while) the user sees it. That is more than a signature-based virus scan: it also catches behaviour that is not yet in a known signature.

It is not a substitute for quarantine, SPF/DKIM/DMARC or MFA. Quarantine holds whole messages; Safe Links/Attachments focus on links and attachments inside (or alongside) that chain. See message quarantine in Microsoft 365 for who may release messages — that agreement belongs in the same mail hygiene.

What an SME typically enables

Three patterns show up. No Defender for Office 365 licence or policy never turned on — then clicks and attachments largely stay on older Exchange Online Protection filters. Licence present, but Safe Links/Attachments “off” or too soft because someone once complained about a false positive — then you pay for protection you do not use. Or everything is on with no exception process: legitimate invoice PDFs or internal tools stall, and the director disables the whole policy “until it works again”.

The practical line: turn Safe Links and Safe Attachments on for users who handle mail and attachments (often everyone with a mailbox); choose a policy that matches your licence (for example dynamic delivery where available, so mail does not sit for hours); and agree how you handle blocked links or attachments — ticket to Floor ICT or a named contact, not “just turn it off”.

False positives: who decides

False positive: a known vendor, an expected attachment, or an internal tool URL that Safe Links or Safe Attachments treat too strictly. A targeted exception or re-check can be right — after verifying sender, domain and content.

Real threat: unknown sender, urgency, lookalike domain, or an attachment/link that does not match an open relationship. Then “do not open / do not bypass” is the default; escalate. Bypassing Safe Links (pasting the URL by hand, “Allow” without a check) undercuts MFA and training — see security awareness.

Unsure = do not bypass. Ask Floor ICT or the process owner; note what you did. Releasing from quarantine and “open anyway despite a Safe Links block” are related choices — see again the quarantine agreement.

What you decide in writing

Keep it short enough to decide this quarter:

• whether Safe Links and Safe Attachments are on for which groups (names or “all mailboxes”);
• who may request exceptions or approve temporary overrides (not “anyone with Outlook”);
• when you escalate to Floor ICT (blocked legitimate invoice, VIP target, repeated phishing URLs);
• that bypassing a block is a deliberate choice: note date, who, which message/URL/attachment, and why;
• review cadence: periodically check whether too many false positives mean policy is too strict or known partners lack allowlists;
• link to quarantine, SPF/DKIM/DMARC, MFA and app consent — one mail hygiene, not loose toggles.

Write those points on one page. That is your Safe Links / Safe Attachments agreement; the tenant follows that text.

What Floor ICT configures — and what you decide

In the Microsoft 365 tenant we typically set: Safe Links and Safe Attachments policies that match your licence; coverage for mail (and Teams/Office where applicable); a workflow for blocked URLs and attachments via ticket to Floor ICT; and alignment with anti-spam, anti-phishing and quarantine. We help analyse false positives and tie this to SPF/DKIM/DMARC and MFA.

You still decide: whether a specific partner URL or attachment type may be “allowed” after review; how strict you want filtering versus how often you accept false positives; and who in your organisation may approve overrides. Technical toggles without that agreement are false comfort; policy without working Safe Links/Attachments is not enough either.