CISA.MS.EXO.15.3 - User click tracking SHOULD be enabled.
Overview
User click tracking SHOULD be enabled.
Rationale: Users may click on malicious links in emails, leading to compromise or unauthorized data disclosure. Enabling user click tracking lets agencies know if a malicious link may have been visited after the fact to help tailor a response to a potential incident.
Remediation action:
- Sign in to Microsoft 365 Defender.
- In the left-hand menu, go to Email & Collaboration > Policies & Rules.
- Select Threat Policies.
- From the Templated policies section, select Preset Security Policies.
- Under either Standard protection or Strict protection, select Manage protection settings.
- Select Next until you reach the Apply Defender for Office 365 protection page.
- On the Apply Defender for Office 365 protection page, select All recipients.
- (Optional) Under Exclude these recipients, add Users and Groups to be exempted from the preset policies.
- Select Next on each page until the Review and confirm your changes page.
- On the Review and confirm your changes page, select Confirm.
Related links
- Defender admin center - Preset security policies
- CISA 15 Link Protection - MS.EXO.15.3
- CISA ScubaGear Rego Reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.15.3 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566.002 Spearphishing Link, T1204.001 Malicious Link |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.15.3 |
| Criticality | SHOULD |
| Upstream requirement | Moved to MS.SECURITYSUITE.7.3v1 (was MS.EXO.15.3v1) |
| Supports controls | cisa-scuba:MS.EXO.15.3, nist-800-53-r5:SI-3, nist-800-53-r5:AU-12c |
| PowerShell test | Test-MtCisaSafeLinkClickTracking |
| Services | ExchangeOnline, Graph, SecurityCompliance |
| Compatible licenses | ATP_ENTERPRISE |