Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Defender XDRMedium
A Microsoft 365 administrator is investigating a series of sophisticated phishing attacks where users are tricked into clicking malicious links that lead to credential harvesting sites. The organization uses Microsoft Defender for Office 365. To prevent future attacks, the administrator needs to ensure that all email links are rewritten and scanned at the time of click, even if a link was initially deemed safe. Additionally, a custom block list of known malicious URLs must be applied globally. Which Defender for Office 365 policy should the administrator configure to achieve these requirements?
- AAnti-phishing policy
- BSafe Links policy
- CSafe Attachments policy
- DAnti-spam policy
Show answer & explanationAnswer & explanation
Correct answer: B. Safe Links policy
Safe Links policies in Microsoft Defender for Office 365 are designed to protect users from malicious links. They rewrite URLs in emails and Office documents, then scan them at the time of click. Safe Links policies also allow administrators to configure custom blocked URLs, directly addressing all stated requirements.
Why the other options are wrong
- A. Anti-phishing policies detect and prevent phishing attempts by analyzing sender, content, and domain reputation, but do not specifically rewrite and scan links at click time or manage custom URL block lists.
- C. Safe Attachments policies protect against malicious attachments by detonating them in a sandbox environment, not by scanning or rewriting links.
- D. Anti-spam policies primarily filter unsolicited bulk email and do not specifically handle link rewriting, click-time scanning, or custom URL block lists for malicious links.
Defender for Office 365 Safe Links
A feature in Microsoft Defender for Office 365 that provides URL scanning and rewriting of inbound email messages and other content. It protects users from malicious links by checking them at the time of click.
- Rewrites URLs in emails and Office documents.
- Scans links in real-time at the time of click.
- Protects against malicious links, even if initially safe.
- Allows for custom blocked URLs configuration.
Memory trick: Safe Links is like a bouncer for URLs, checking every ID at the door, even if they passed the first check.