---
name: Safe Links and Safe Attachments Coverage
description: Read-only audit of Microsoft Defender for Office 365 Safe Links and Safe Attachments policy coverage across users and domains.
---

# Safe Links and Safe Attachments Coverage

> **TL;DR:** This skill inspects your Microsoft Defender for Office 365 Safe Links and Safe Attachments policies, then scores how completely they protect users, mailboxes and domains without changing anything.

## How does Microsoft Defender for Office 365 protect users with Safe Links and Safe Attachments?

Microsoft Defender for Office 365 extends Exchange Online Protection with two preventive controls: Safe Links rewrites and time-of-click scans URLs in email, Microsoft Teams and supported Office apps, while Safe Attachments detonates email attachments and files in SharePoint, OneDrive and Microsoft Teams within a sandbox before delivery. This skill reads the configured policies and the recipients they apply to, then identifies users and domains left uncovered or covered by weak settings. Reporting and policy management are centralised through the Microsoft Defender portal and surfaced in Microsoft Defender XDR.

## When should you run this skill?

- "Which users are not covered by any Safe Links or Safe Attachments policy?"
- "Are our Safe Attachments policies set to block rather than monitor?"
- "Show me domains that fall outside our Defender for Office 365 protection."
- "Do our Safe Links policies cover Microsoft Teams and Office apps, not just email?"
- "We have a security review coming up, where are the gaps in our email protection coverage?"
- "Is time-of-click protection enabled and are users blocked from clicking through warnings?"
- "Give me an evidence pack for our Defender for Office 365 preventive controls."

## How this skill works, step by step

1. Connect read-only to the Microsoft Defender portal and Exchange Online to enumerate Safe Links and Safe Attachments policies and their associated recipient rules.
2. Inventory each policy and record its action settings, including Safe Attachments action (block, monitor, replace or dynamic delivery) and Safe Links options for email, Teams and Office apps.
3. Resolve each policy's scope to the users, groups and domains it applies to, accounting for rule priority and exclusions.
4. Cross-reference accepted domains and the active user population to identify recipients with no effective policy applied.
5. Flag weak configurations such as Safe Attachments left in monitor mode, Safe Links with click-through allowed, or disabled time-of-click scanning.
6. Confirm whether preset security policies (Standard or Strict) are enabled, since these provide baseline coverage when custom policies are absent.
7. Derive a per-recipient risk score: each gap is weighted by exposure (no policy at all scores higher than a weak setting; mailboxes with external mail flow score higher), then aggregated into an overall coverage indicator.
8. Compile the findings into a structured table with remediation guidance and supporting evidence references.

## Output format

The skill returns a coverage table followed by a short summary. Each row covers one user segment, domain or policy gap, its observed state and the recommended action.

| Scope | Control | Observed state | Risk | Recommendation |
| --- | --- | --- | --- | --- |
| `finance` group (42 users) | Safe Attachments | Monitor mode | High | Change action to block so malicious attachments are not delivered |
| `contoso-au.com` domain | Safe Links | No policy applied | High | Extend a Safe Links policy or enable a preset security policy to cover this domain |

Summary points returned alongside the table:

- Count of users and domains with full coverage, weak coverage and no coverage.
- Whether Safe Attachments policies are set to block and Safe Links covers email, Teams and Office apps.
- Overall protection coverage indicator and the top remediation priorities.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Safe Links and Safe Attachments policy management and reporting | Microsoft Defender for Office 365 Plan 1 (included in Microsoft 365 E5) |
| Threat investigation and advanced hunting for detonation events | Microsoft Defender for Office 365 Plan 2 (included in Microsoft 365 E5) |
| Exchange Online recipient and domain resolution | Exchange Online Plan 1 (included in Microsoft 365 E3) |

### Least-privilege roles

- Security Reader (Microsoft Entra) for read-only visibility of Defender for Office 365 policies and reports.
- Global Reader for read-only review of Exchange Online recipients and accepted domains.

### Microsoft Graph permissions (read-only)

- Safe Links and Safe Attachments policies are administered through the Microsoft Defender portal and Exchange Online PowerShell rather than Microsoft Graph; the skill reads policy state via portal reports and read-only PowerShell cmdlets such as `Get-SafeLinksPolicy` and `Get-SafeAttachmentPolicy`.
- `User.Read.All` - reads the active user population and group membership to resolve which recipients fall within or outside policy scope, where this signal is sourced via Microsoft Graph.

## Scope and safety

This skill is read-only by default. It inspects policy configuration and recipient data and never changes policies, actions or recipient assignments.

This skill does NOT:

- Modify, create, enable or disable any Safe Links or Safe Attachments policy.
- Change Safe Attachments actions or Safe Links click-through settings.
- Quarantine, release or take any action on messages, attachments or files.
- Write to the Microsoft Defender portal, Exchange Online or recipient mailboxes.

## Sources and compliance

- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)
- [Safe Attachments in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about)
- Maps to the Essential Eight user application hardening and supports ISM controls for email content filtering, malicious code prevention and protection against malicious web content.
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Output in Australian English.