• United States



Contributing Writer

How to set Microsoft Office 365 ATP policies to block malicious URLs

Jan 03, 20194 mins
PhishingSecuritySmall and Medium Business

Windows Advanced Threat Protection allows admins to set link filters for email messages and attachments in Outlook.

Computerworld Cheat Sheet - Microsoft Outlook 2016
Credit: Microsoft

A key recommendation to ensure a secure Office 365 implementation is to scan your Outlook implementation to check for malicious links using Office 365 ATP Safe links and Office 365 ATP safe attachments. Before a user clicks on a link, the URL is rewritten to be scanned first by Microsoft scanning filters.

You might have already seen this in action if you use or Hotmail. Office 365 allows you to enable this feature as well. ATP Safe Links features are part of Advanced Threat Protection, which is included in Office 365 Enterprise E5, Microsoft 365 Business and Microsoft 365 Enterprise. You can add protection to other 365 plans for a minimal fee.

To set up a policy to explicitly block a URL for everyone in the firm, first sign in with your admin account. In the left navigation under “Threat management”, choose “Policy”.

bradley atp link 1 Microsoft

Setting up the ATP policies

You can now review the policies set in both ATP Safe Attachments and ATP Safe Links.

bradley atp link 2 Microsoft

ATP Safe Attachments and ATP Safe Links

Starting with ATP Safe Attachments, enable ATP for all the platforms you have defaults for. In this example of a Microsoft 365 E5 deployment, you will want to turn on ATP for SharePoint, OneDrive and Teams by checking the box in the implementation.

bradley atp link 3 Microsoft

Default checkbox to enable protection of files

To enable a policy for email attachments, click the “+” to add a new policy item. You can then choose to monitor, block or replace the message as you see fit.

bradley atp link 4 Microsoft

Setting up policy to block

Email link filtering in Microsoft Office 365 occurs when the system is set to scan and rewrite URLs in email. This ensures that they are sent through a phishing filter first before the user is allowed to click on a link. You have probably seen the result of this process when someone resends an email and the URL links include an embedded reference to an Outlook web link.

For example, rather than seeing or clicking on the link, you will instead see: 7C03ad8656b0e749b9a21f95b0cf1efeb4%7C1%7C0%7C636803595870882059& sdata=eXmZIWg2xY53VqgzzoA4uk0G7pEYfcHRPtTp%2FT8Mg14%3D&reserved=0  

While this resulting URL might look suspicious, what the system is doing is sending the URL through a spam filtering service first and allowing you, the administrator, to know which user clicked on the link.

To set up email link filtering, click on ATP Safe Links. Scroll down to “Policies that apply to specific recipients”. Click the”+” to set up a policy. Choose the sections to enable the scanning of links in emails.

bradley atp link 5 Microsoft

Set up the URL filtering policy

In my sample setup, I am choosing to have this apply to the entire domain.

bradley atp link 6 Microsoft

Setting up the entire domain

Choose “Save”.

Now when someone sends you an email with a link in it, the email content will be scanned to ensure it does not contain malicious content. The URL will be automatically rewritten to ensure that it is scanned and you can review the action that was taken on the emails. In my sample, you can see that some emails in our testing have been delivered, and some with the most malicious of attachments were blocked.

bradley atp link 7 Microsoft

Sample alerts on actions taken in mailbox

With this information the administrator can take action as needed to protect the end user.

Contributing Writer

Susan Bradley has been patching since before the Code Red/Nimda days and remembers exactly where she was when SQL slammer hit (trying to buy something on eBay and wondering why the Internet was so slow). She writes the Patch Watch column for, is a moderator on the listserve, and writes a column of Windows security tips for In real life, she’s the IT wrangler at her firm, Tamiyasu, Smith, Horn and Braun, where she manages a fleet of Windows servers, Microsoft 365 deployments, Azure instances, desktops, a few Macs, several iPads, a few Surface devices, several iPhones and tries to keep patches up to date on all of them. In addition, she provides forensic computer investigations for the litigation consulting arm of the firm. She blogs at and is on twitter at @sbsdiva. She lurks on Twitter and Facebook, so if you are on Facebook with her, she really did read what you posted. She has a SANS/GSEC certification in security and prefers Heavy Duty Reynolds wrap for her tinfoil hat.

More from this author