Set up Office 365 ATP Safe Links policies

• 02/26/2019
• 7 minutes to read
• Contributors
  • 
  • 

ATP Safe Links, a feature of Office 365 Advanced Threat Protection (ATP), can help protect your organization from malicious links used in phishing and other attacks. If you have the necessary permissions for the Office 365 Security & Compliance Center, you can set up ATP Safe Links policies to help ensure that when people click web addresses (URLs), your organization is protected. Your ATP Safe Links policies can be configured to scan URLs in email and URLs in Office documents.

New features are continually being added to ATP. As new features are added, you may need to make adjustments to your existing ATP Safe Links policies.

What to do

1. Review the prerequisites.

2. Review and edit the default ATP Safe Links policy that applies to everyone. For example, you can set up your custom blocked URLs list for ATP Safe Links.

3. Add or edit policies for specific email recipients, including setting up your custom "Do not rewrite" URLs list for ATP Safe Links.

4. Learn about ATP Safe Links policy options (in this article), including settings for recent changes.

Step 1: Review the prerequisites

• Make sure that your organization has Office 365 Advanced Threat Protection.

• Make sure that you have the necessary permissions. To define (or edit) ATP policies, you must be assigned an appropriate role. Some examples are described in the following table:
  

  Role	Where/how assigned
  Office 365 Global Administrator	The person who signs up to buy Office 365 is a global admin by default. (See About Office 365 admin roles to learn more.)
  Security Administrator	Azure Active Directory admin center (https://aad.portal.azure.com)
  Exchange Online Organization Management	Exchange admin center (https://outlook.office365.com/ecp) or PowerShell cmdlets (See Exchange Online PowerShell)

  To learn more about roles and permissions, see Permissions in the Office 365 Security & Compliance Center.

• Make sure that Office clients are configured to use Modern Authentication (this is for ATP Safe Links protection in Office documents).

• Learn about ATP Safe Links policy options (in this article).

• Allow up to 30 minutes for your new or updated policy to spread to all Office 365 datacenters.

Step 2: Define (or review) the ATP Safe Links policy that applies to everyone

When you have Office 365 Advanced Threat Protection, you will have a default ATP Safe Links policy that applies to everyone in your organization. Make sure to review, and if needed, edit your default policy.

1. Go to https://protection.office.com and sign in with your work or school account.

2. In the left navigation, under Threat management, choose Policy > Safe Links.

3. In the Policies that apply to the entire organization section, select Default, and then choose Edit (the Edit button resembles a pencil).
   

4. In the Block the following URLs section, specify one or more URLs that you want to prevent people in your organization from visiting. (See Set up a custom blocked URLs list using ATP Safe Links.)

5. In the Settings that apply to content except email section, select (or clear) the options you want to use. (We recommend that you select all the options.)

6. Choose Save.

Step 3: Add (or edit) ATP Safe Links policies that apply to specific email recipients

After you have reviewed (or edited) the default ATP Safe Links policy that applies to everyone, your next step is to define additional policies that would apply to specific recipients. For example, you can specify exceptions to your default policy by defining an additional policy.

1. Go to https://protection.office.com and sign in with your work or school account.

2. In the left navigation, under Threat management, choose Policy.

3. Choose Safe Links.

4. In the Policies that apply to specific recipients section, choose New (the New button resembles a plus sign ( +)).
   

5. Specify the name, description, and settings for your policy.
   Example: To set up a policy called "no direct click through" that does not allow people in a certain group in your organization to click through to a specific website without ATP Safe Links protection, you might specify the following recommended settings:

• In the Name box, type no direct click through.

• In the Description box, type a description like, Prevents people in certain groups from clicking through to a website without ATP Safe Links verification.

• In the Select the action section, choose On.

• Select Use Safe Attachments to scan downloadable content.

• If this option is available, select Apply Safe Links to messages sent within the organization.

• Select Do not allow user to click through to original URL.

• (This is optional) In the Do not rewrite the following URLs section, specify one or more URLs that are considered to be safe for your organization. (See Set up a custom "Do not rewrite" URLs list using ATP Safe Links)

• In the Applied To section, choose The recipient is a member of, and then choose the group(s) you want to include in your policy. Choose Add, and then choose OK.

6. Choose Save.

Step 4: Learn about ATP Safe Links policy options

As you set up or edit your ATP Safe Links policies, will see several options available. In case you are wondering what these options are, the following table describes each one and its effect. Remember that there are two main kinds of ATP Safe Links policies to define or edit:

• a default policy that applies to everyone; and
• additional policies for specific recipients

Default policy options

Default policy options apply to everyone in your organization.

Policies that apply to specific email recipients

Next steps

Once your ATP Safe Links policies are in place, you can see how ATP is working for your orgnization by viewing reports. See the following resources to learn more:

• View reports for Office 365 Advanced Threat Protection

• Use Explorer in the Security & Compliance Center

Stay on top of new features coming to ATP. visit the Microsoft 365 Roadmap and learn about new features that are being added to ATP.