CISA.MS.EXO.15.1 - URL comparison with a block-list SHOULD be enabled.
Overview
URL comparison with a block-list SHOULD be enabled.
Rationale: Users may be directed to malicious websites via links in email. Blocking access to known, malicious URLs can prevent users from accessing known malicious websites.
Remediation action:
- Sign in to Microsoft 365 Defender.
- In the left-hand menu, go to Email & Collaboration > Policies & Rules.
- Select Threat Policies.
- From the Templated policies section, select Preset Security Policies.
- Under either Standard protection or Strict protection, select Manage protection settings.
- Select Next until you reach the Apply Defender for Office 365 protection page.
- On the Apply Defender for Office 365 protection page, select All recipients.
- (Optional) Under Exclude these recipients, add Users and Groups to be exempted from the preset policies.
- Select Next on each page until the Review and confirm your changes page.
- On the Review and confirm your changes page, select Confirm.
Related links
- Defender admin center - Preset security policies
- CISA 15 Link Protection - MS.EXO.15.1
- CISA ScubaGear Rego Reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.15.1 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566.002 Spearphishing Link, T1204.001 Malicious Link |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.15.1 |
| Criticality | SHOULD |
| Upstream requirement | Moved to MS.SECURITYSUITE.7.1v1 (was MS.EXO.15.1v1) |
| Supports controls | cisa-scuba:MS.EXO.15.1, nist-800-53-r5:SI-3 |
| PowerShell test | Test-MtCisaSafeLink |
| Services | ExchangeOnline, Graph, SecurityCompliance |
| Compatible licenses | ATP_ENTERPRISE |