How to set Microsoft Office 365 ATP policies to block malicious URLs

Windows Advanced Threat Protection allows admins to set link filters for email messages and attachments in Outlook.

Current Job Listings

A key recommendation to ensure a secure Office 365 implementation is to scan your Outlook implementation to check for malicious links using Office 365 ATP Safe links and Office 365 ATP safe attachments. Before a user clicks on a link, the URL is rewritten to be scanned first by Microsoft scanning filters.

You might have already seen this in action if you use Outlook.com or Hotmail. Office 365 allows you to enable this feature as well. ATP Safe Links features are part of Advanced Threat Protection, which is included in Office 365 Enterprise E5, Microsoft 365 Business and Microsoft 365 Enterprise. You can add protection to other 365 plans for a minimal fee.

To set up a policy to explicitly block a URL for everyone in the firm, first sign in with your admin account. In the left navigation under “Threat management”, choose “Policy”.

bradley atp link 1 Microsoft

Setting up the ATP policies

You can now review the policies set in both ATP Safe Attachments and ATP Safe Links.

Starting with ATP Safe Attachments, enable ATP for all the platforms you have defaults for. In this example of a Microsoft 365 E5 deployment, you will want to turn on ATP for SharePoint, OneDrive and Teams by checking the box in the implementation.

To enable a policy for email attachments, click the “+” to add a new policy item. You can then choose to monitor, block or replace the message as you see fit.

How email link filtering works in Office 365

Email link filtering in Microsoft Office 365 occurs when the system is set to scan and rewrite URLs in email. This ensures that they are sent through a phishing filter first before the user is allowed to click on a link. You have probably seen the result of this process when someone resends an email and the URL links include an embedded reference to an Outlook web link.

For example, rather than seeing or clicking on the link www.malciouslinks.com, you will instead see:

 https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.maliciouslinks.com&data=02%7C01%7CSusantest%40
smallbusinesssusan.onmicrosoft.com%7C3fd031c8ec4a4e5925e908d6617f1a3c%
7C03ad8656b0e749b9a21f95b0cf1efeb4%7C1%7C0%7C636803595870882059&
sdata=eXmZIWg2xY53VqgzzoA4uk0G7pEYfcHRPtTp%2FT8Mg14%3D&reserved=0  

While this resulting URL might look suspicious, what the system is doing is sending the URL through a spam filtering service first and allowing you, the administrator, to know which user clicked on the link.

To set up email link filtering, click on ATP Safe Links. Scroll down to “Policies that apply to specific recipients”. Click the”+” to set up a policy. Choose the sections to enable the scanning of links in emails.

To continue reading this article register now

SUBSCRIBE! Get the best of CSO delivered to your email inbox.