June 30, 2021
Microsoft Security

Microsoft Defender for Office 365: Time-of-click protection against phishing attacks

Microsoft Security logo

This video demonstrates Safe Links time-of-click protection in Microsoft Defender for Office 365—how it scans and rewrites URLs during mail flow, then re-checks them the moment a user clicks. It explains why that matters: attackers can send an email with a link that initially redirects to a safe site, wait until it lands in the inbox, then weaponize the redirect to a phishing page. Safe Links counters that by verifying the URL at click time—showing users a Safe Links block page if it’s malicious and generating alerts for SecOps in Microsoft 365 Defender. The demo also covers coverage beyond email: Safe Links can check links opened from documents and from Microsoft Teams. To enable it, you configure Safe Links policies under Policies & rules > Threat policies > Safe Links (there are no default policies), turn on protection for URLs in email and URLs in Teams, and ensure the global setting Use Safe Links for Office 365 apps is enabled for users covered by a Safe Links policy.

We produced this as a short, punchy feature proof: establish the attacker trick, show how Safe Links breaks it, then land on the exact policy knobs that make it real. The screen capture stays tight on the settings that matter (policy creation, URL protections, global app setting), and the edit keeps the cadence brisk so viewers come away with a simple mental model: rewrite in transit, validate at click, block when it turns bad. Final delivery includes closed captions, audio description, and thumbnails.

Microsoft Security logo
Share this video