# How do Safe Links and Safe Attachments work in Microsoft 365, and how do you set them up?

URL: https://iblockspam.com/blog/microsoft-365-safe-links-safe-attachments
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Setup guides
Author: iBlockSpam Team

> What Safe Links and Safe Attachments do, who is licensed, what Built-in protection sets, Dynamic Delivery, URL rewriting, and how they work behind a gateway.

## Short answer

Safe Links checks URLs during delivery and again when users click them. Safe Attachments opens attachments in a virtual environment before delivery. Both need Defender for Office 365 Plan 1 or higher. Built-in protection turns them on for everyone, but without URL rewriting and with click-through allowed, so assign the Standard or Strict preset for stronger settings.

Safe Links and Safe Attachments are the two Defender for Office 365 features that deal with threats a normal spam filter can miss: a link that's clean at delivery and malicious an hour later, and a document whose malware only shows when it's opened. Many tenants have them switched on without knowing it, through the Built-in protection preset, but with weaker settings than Microsoft recommends for most users.

This guide explains what each feature does, what Built-in protection actually sets, the settings worth changing, and how both behave when a filtering gateway sits in front of Microsoft 365.

## What do Safe Links and Safe Attachments do?

| | Safe Links | Safe Attachments |
|---|---|---|
| Protects against | Malicious URLs in email, Teams and Office files | Malicious attachments, including ones antivirus signatures miss |
| How | Scans URLs in mail flow, rewrites them, and checks them again at the time of click | Opens attachments in a virtual environment before delivery, a process Microsoft calls detonation |
| Runs | During delivery and at every click | Before delivery, after normal anti-malware scanning |
| Typical delay | Messages can be held until URL scanning completes | Microsoft says scanning "typically" completes within 15 minutes |
| Also covers | Teams chats and channels; links in supported Office apps | SharePoint, OneDrive and Teams files, through a separate global setting |

Rewritten links point to `https://<DataCenterLocation>.safelinks.protection.outlook.com` ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)). Hovering in Outlook still shows the original URL. If a link turns out to be malicious after delivery, the click lands on a warning page instead of the site.

Neither feature replaces anti-spam or anti-phishing filtering. They add a second look at links and files. For the wider protection stack, see [how to stop phishing emails in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365).

## Which licenses include them?

Safe Links and Safe Attachments are part of **Defender for Office 365 Plan 1**, and Plan 2 includes everything in Plan 1. According to Microsoft's [service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description), Plan 1 is included in Microsoft 365 Business Premium (and, from July 1, 2026, in Office 365 E3 and Microsoft 365 E3), and Plan 2 in subscriptions such as Microsoft 365 E5. Business Basic and Business Standard need the add-on. Our [Plan 1 vs Plan 2 comparison](https://iblockspam.com/blog/defender-for-office-365-plan-1-vs-plan-2) covers which suites include what at the time of writing (October 2026).

Two licensing points catch people out:

- **Built-in protection switches on with any number of licenses.** Microsoft applies it "to all users in organizations with any number of licenses" and says customers "don't need to worry about violating product licensing terms", but recommends buying enough licenses so protection continues for everyone.
- **Partial licensing needs scoping.** If only some users are licensed, Microsoft suggests user or group exceptions so policies apply only to eligible users.

## What does Built-in protection actually set?

There's no default Safe Links or Safe Attachments policy. Instead, the **Built-in protection** preset covers every recipient who isn't in the Standard or Strict preset or in a custom Safe Links or Safe Attachments policy. It's always applied last ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies)).

It isn't the same as the Standard and Strict presets. The Safe Attachments settings match. The Safe Links settings don't:

| Safe Links setting | Built-in protection | Standard and Strict |
|---|---|---|
| Do not rewrite URLs, do checks via Safe Links API only | On (no rewriting) | Off (URLs rewritten) |
| Let users click through to the original URL | On | Off |
| Apply Safe Links to email messages sent within the organization | Off | On |
| Wait for URL scanning to complete before delivering the message | On | On |
| Track user clicks | On | On |

The gap matters. Without rewriting, Microsoft says unwrapped URLs are checked at click time through an API call only "in supported versions of Outlook (Windows, Mac, and Outlook on the web)". Its own example describes a user who clicks a link in another email client: the link "was legitimate on delivery, but was later weaponized", and the user "is phished". With click-through allowed, a user who sees a warning can still continue to the site.

So treat Built-in protection as a safety net, not your configuration. Put real users in the Standard or Strict preset. Our guide to [Microsoft 365 preset security policies](https://iblockspam.com/blog/microsoft-365-preset-security-policies) explains how to assign them.

## Which Safe Attachments settings matter?

### Unknown malware response

This is the main setting. The options ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about)):

- **Off**: no Safe Attachments scanning; normal anti-malware scanning still runs. Microsoft says it's "not recommended for most users", and notes ZAP doesn't quarantine messages in some cases when it's off.
- **Monitor**: delivers the message, then tracks what happens with detected threats. Redirecting detected messages to an analysis mailbox is available only with this action.
- **Block**: quarantines messages with detected attachments and blocks future instances of the same attachments. It's the default and the value in all three presets.
- **Dynamic Delivery**: delivers the body immediately with placeholders, and releases each attachment once it's found safe. Malicious messages are quarantined.

Dynamic Delivery is the usual answer to "attachments are slow". Know its limits first. Microsoft says it "works only for Exchange Online mailboxes", and lists cases where placeholders can't be replaced, including messages moved by Inbox rules, messages moved to archive folders, public folders and S/MIME encrypted mail.

### Quarantine and password-protected files

Detections go to quarantine under AdminOnlyAccessPolicy by default. Users can't release messages that Safe Attachments quarantined as malware or phishing; at most they can request release.

**Block unscanned attachments** quarantines messages with password-protected attachments Safe Attachments can't open. It's off in all presets. If you turn it on, users can release a message by supplying the attachment password, which triggers a fresh scan before release. Microsoft warns users to enter only the attachment password there, never account or banking passwords.

### Global settings

**Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams** is a tenant-wide switch, separate from policies. Built-in protection sets it to on.

## Which Safe Links settings matter?

- **URL rewriting.** Leave rewriting on (the **Do not rewrite URLs** box cleared) for the strongest protection. As of October 2026, Microsoft says Safe Links no longer wraps SharePoint or OneDrive URLs but still processes them.
- **Wait for URL scanning to complete before delivering the message.** On in every preset. Turning it off delivers the message even if the scan can't finish.
- **Apply Safe Links to email messages sent within the organization.** On in Standard and Strict. It protects against a compromised internal account sending links to colleagues.
- **Let users click through to the original URL.** Microsoft recommends off.
- **Do not rewrite the following URLs.** Entries aren't scanned or wrapped during mail flow but can still be blocked at click time. Microsoft recommends reporting a good URL as clean and choosing **Allow this URL** instead, which adds a Tenant Allow/Block List entry.
- **Teams** and **Office 365 apps**. Time-of-click checks without rewriting. Microsoft says the Teams setting can take up to 24 hours to apply.

Safe Links supports HTTP, HTTPS and FTP links, ignores S/MIME signed messages and doesn't protect URLs in RTF (TNEF) messages.

## How do you set them up?

The quickest route uses the presets:

1. In the Microsoft Defender portal, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Preset Security Policies** (`https://security.microsoft.com/presetSecurityPolicies`).
2. Turn on **Standard protection** and assign all licensed users on the **Apply Defender for Office 365 protection** page. Assign **Strict protection** to high-risk groups.
3. Check the global Safe Attachments setting for SharePoint, OneDrive and Teams.

If you need custom policies instead, for example Dynamic Delivery for one team:

1. Go to **Threat policies** > **Safe Attachments** (`https://security.microsoft.com/safeattachmentv2`) or **Safe Links** (`https://security.microsoft.com/safelinksv2`) in the **Policies** section and select **Create**.
2. Choose users, groups or domains. Leaving all three blank applies the policy to all recipients.
3. Start from the Standard values in Microsoft's [recommended settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365) and change only what you need.
4. Allow time to apply: up to 30 minutes for Safe Attachments and up to 6 hours for Safe Links, according to Microsoft.

Remember that presets always win. A custom policy has no effect on anyone who's also in Standard or Strict.

## How do you test them?

1. **Safe Links:** send a message containing `http://spamlink.contoso.com` from an outside account. Microsoft documents this URL as a harmless test that "triggers a Safe Links protection response". Check that the link is rewritten (view the message source or hover) and that clicking it shows a warning page.
2. **Headers:** paste the test message's headers into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to confirm which path it took.
3. **Reports:** open the **Threat protection status** report from the Safe Links or Safe Attachments page with **View reports**. Plan 1 tenants can also use **Real-time detections**.
4. **Users:** ask a pilot user on each Outlook client you support to confirm links behave as expected, especially if any users still sit under Built-in protection.

## What changes when a gateway sits in front of Microsoft 365?

Safe Links and Safe Attachments still work when your MX points to a filtering service, provided Microsoft 365 sees the mail correctly. Three things to get right:

1. **Turn on Enhanced Filtering for Connectors.** Microsoft fully supports the layout where the MX points to another service, with Enhanced Filtering on the inbound connector so Microsoft 365 sees the original sender. Our [Enhanced Filtering guide](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) covers the steps.
2. **Avoid double link wrapping.** Microsoft warns that double wrapping "can prevent Safe Links from validating link status, detonating links for threats, and potentially triggering one-time use links", and recommends "disabling the link wrapping feature in the non-Microsoft service" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)). If you can't, decide which product owns link rewriting and turn it off in the other.
3. **Plan for two quarantines.** A message can be held by the gateway or by Safe Attachments. Tell users and helpdesk staff where to look, and report each false positive to the layer that held it.

Avoid routing mail out of Microsoft 365 to another service and back in. Microsoft "strongly" recommends against it, because returning messages are treated as new and can be misjudged as spoofing. And don't use an SCL -1 rule or the IP Allow List to wave gateway traffic through; Microsoft warns that these workarounds can lead to malicious messages being delivered.

## Next steps

- Check who is still covered only by Built-in protection, and move them into Standard or Strict.
- Send the `spamlink.contoso.com` test to one mailbox on each client you support.
- Review your [anti-spam policy settings](https://iblockspam.com/blog/microsoft-365-anti-spam-policies) at the same time, since presets replace those too.
- If you're adding a gateway in front of Defender, read [Defender for Office 365 vs an email gateway](https://iblockspam.com/compare/defender-for-office-365-vs-email-gateway). iBlockSpam is one option that uses the Partner connector and Enhanced Filtering setup Microsoft documents.

Browse all [spam filter setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### Do I need Defender for Office 365 for Safe Links and Safe Attachments?

Yes. Both are Defender for Office 365 features, included from Plan 1 upward. Microsoft 365 Business Premium includes Plan 1, and Microsoft 365 E5 includes Plan 2. Tenants with only the built-in protection for cloud mailboxes get anti-malware scanning but not sandboxing of attachments or time-of-click link checks.

### Why aren't links being rewritten in my users' email?

Probably because those users are covered only by the Built-in protection preset. Microsoft sets Do not rewrite URLs, do checks via Safe Links API only to on in Built-in protection, so links are scanned at delivery and checked at click time through the API in supported Outlook versions, but not wrapped. The Standard and Strict presets rewrite URLs.

### What is Dynamic Delivery in Safe Attachments?

Dynamic Delivery delivers the message body straight away with a placeholder for each attachment, then makes the attachment available once scanning finds it safe. If the attachment is malicious, the message is quarantined. Microsoft says it works only for Exchange Online mailboxes. Block, the default and the preset value, holds the whole message until scanning finishes.

### How long does Safe Attachments delay email?

Microsoft says attachment scanning typically completes within 15 minutes, and sometimes takes longer because of retry delays and analysis time. With the Block action, delivery waits for the scan. With Dynamic Delivery, the message body arrives immediately and only the attachment waits.

### How do I test that Safe Links is working?

Microsoft provides a harmless test URL, http://spamlink.contoso.com, which triggers a Safe Links response in the same way GTUBE text tests anti-spam. Send it to a protected mailbox from outside, click it, and check that a warning page appears. Also review the Threat protection status report in the Defender portal.

## Sources

- [Microsoft Learn: Safe Links overview](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)
- [Microsoft Learn: Safe Attachments](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about)
- [Microsoft Learn: Set up Safe Links policies](https://learn.microsoft.com/en-us/defender-office-365/safe-links-policies-configure)
- [Microsoft Learn: Set up Safe Attachments policies](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-policies-configure)
- [Microsoft Learn: Recommended email and collaboration threat policy settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)
- [Microsoft Learn: Integrate non-Microsoft security services with Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)
- [Microsoft Learn: Microsoft Defender for Office 365 service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-safe-links-safe-attachments (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt