ORCA.226 - Each domain has a Safe Link policy applied to it.
Overview
Microsoft Defender for Office 365 Safe Links policies are applied using rules. The recipient domain condition is the most effective way of applying the Safe Links policy, ensuring no users are left without protection. If polices are applied using group membership make sure you cover all users through this method. Applying polices this way can be challenging, users may left unprotected if group memberships are not accurate and up to date. It is important not to rely on the 'built-in' Safe Links policy, as this policy only applies the minimum level of protections and should serve as a catch-all.
Remediation action
Apply a Safe Links policy to every domain.
Related Links
- Microsoft 365 Defender Portal - Safe links
- Order and precedence of email protection
- Recommended settings for EOP and Microsoft Defender for Office 365
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.226 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566.002 Spearphishing Link, T1204.001 Malicious Link |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA226 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.226.ps1 - Documentation:
tests/orca/Test.ORCA.226.md