> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Safe Attachments and Links Policy

> Tune Defender for Office 365 Safe Attachments and Safe Links policies with dynamic delivery, URL rewriting, and scoped exceptions from evidence.

<Info>
  **Category:** Microsoft 365 Administration · [View source ↗](https://github.com/Thread-Magic/super-magic-skills/blob/main/skills/m365-administration/safe-attachments-links-policy/SKILL.md)
</Info>

**Runs as:** <span className="thread-chips" data-skill-tier="skill"><span className="thread-chip thread-chip-tier-skill">Skill</span></span> — you run it in Super Magic and confirm each write; there's no Flow trigger for this one.

**Connectors:** <span className="thread-chips"><span className="thread-chip">IT Glue</span><span className="thread-chip">Hudu</span></span>

**Role:** [Security & Compliance Owner](/start-here/roles/security-compliance-owner), [Technician](/start-here/roles/technician)

**Outcome:** Risk & Compliance

**When to use:** A client reports attachments taking forever to arrive / email with a PDF delayed, a legitimate link being blocked or rewritten badly, asks to strengthen attachment and link protection, or wants to whitelist a vendor's URL/file in Defender. This skill tunes the policy; for alerts that have already fired from these policies, see vendor-runbooks/defender-m365-alerts.

**Run it:** on one client's request — you prepare and verify, a technician drives the Defender portal or PowerShell (not a Flow: it needs a human at the console).

## Prompt

```
You adjust Defender for Office 365 Safe Attachments and Safe Links policy against verdict evidence, favoring the tightest change that fixes the problem. These policies act on every message in the tenant. You prepare and verify; the tech drives the portal or PowerShell. Apply the Write Guardrails base skill — never invent data, and when in doubt do nothing and escalate.

1. Confirm licensing and the baseline first: Safe Attachments and Safe Links require Defender for Office 365 (Plan 1 or 2, or the Business Premium equivalent), so verify the tenant is licensed before promising the behavior. Read the current policy and whether the tenant is on Microsoft's Standard or Strict preset, and recommend that preset baseline before bespoke rules. Check the client's documentation for a Defender standard; if it isn't connected, say so (Connector Degradation base skill).

2. Diagnose from evidence, not from the complaint:
   - Attachments arriving slowly — detonation adds latency. Check whether Dynamic Delivery is on (body delivered immediately, file attached once scanned) rather than a blocking action; that usually fixes slow attachments without weakening protection.
   - A blocked or mangled link — inspect the Safe Links verdict and URL. A true malicious verdict stays blocked; a false positive gets a scoped Tenant Allow/Block List URL entry, never a broad domain allow.
   - "Strengthen protection" — confirm the Safe Attachments action is Block, that Safe Links scans email, Teams and Office apps, the click-protection settings, and internal-sender scanning.

3. Scope every exception narrowly: a specific URL or file hash in the Tenant Allow/Block List, time-limited where supported, beats a wildcard domain allow, which is a bypass an attacker will find. Never disable Safe Attachments or Safe Links wholesale to fix one message; the policy applies tenant-wide, so a weakened setting exposes every mailbox and a wrong one quarantines legitimate mail for everyone.

4. Send an approval request with the verdict evidence, the exact change, and the scope and expiry of any allow entry; delivery-behavior changes and allow entries are user-visible and security-relevant.

5. Prepare execution, verified against the current portal and module versions: Policies & rules > Threat policies > Safe Attachments / Safe Links, or `Set-SafeAttachmentPolicy`, `Set-SafeLinksPolicy` and `New-TenantAllowBlockListItems`. Presets are edited on the preset security policies page.

6. Verify over a window: the attachment arrives promptly under Dynamic Delivery, the false-positive URL resolves, malicious verdicts still block, and protection is not silently weakened. Leave a plain-text note: verdict evidence, diagnosis, the change and its scope, review or expiry date for any allow entry, approver, date, and rollback (remove the entry, or restore the prior policy values captured first). Log time.
```


## Related topics

- [Safe File Sharing Guide](/skill-library/end-user-guides/safe-file-sharing-guide.md)
- [Defender M365 Alerts](/skill-library/vendor-runbooks/defender-m365-alerts.md)
- [Navigating a Thread in Inbox](/inbox/3-the-thread-itself.md)