Safe Links
What is Safe Links?
Safe Links is part of Microsoft Defender for Office 365 (formerly known as Office 365 Advanced Threat Protection - ATP). This feature rewrites every URL found in an incoming email in order to redirect users through a Microsoft proxy server which checks at the time of click if the URL is safe to view.
When a URL in an email or Microsoft Office Online document is clicked, Safe Links performs a scan to determine if the hyperlink is malicious. Safe Links also scans any documents available on that link at the time of click to prevent malicious file downloads to your system.
If the link is determined to be safe to view, you will proceed as expected; if the link is determined to contain malicious content, you are redirected to a warning page instead.
Only incoming links are rewritten. When a user writes an email to an external party, the URLs in that message are not rewritten.
What does Safe Links look like?
The hyperlink in the email that you receive will be rewritten and may appear differently than they are originally displayed.
Here is an example when you put your mouse over a Book_Now>> hyperlink and you will notice the URL starts with the Microsoft Defender proxy server like apc01.safelinks.protection.outlook.com:
Another example of a URL rewritten with Safe Links:
https://apc01.safelinks.protection.outlook.com/url=https%3A%2F%2Fhk.yahoo.com%2F
&data=01%7C01%7Ccctest%40ust.hk%7C4df1629173e841c3319e08d755ce53ac%7C
c917f3e2932249269bb3daca730413ca%7C1&sdata=jc7kYBDZbzsfu%2BBYzyXb1ZL8Ld
PRTE7U1Pl5OZYG%2BSA%3D&reserved=0
The highlighted sections include:
apc01.safelinks.protection.outlook.com/ - the Microsoft Defender proxy server
url=https%3A%2F%2Fhk.yahoo.com – the destination web address, address ends just before &data=
cctest%40ust.hk – the email address of the recipient (your email address will only appear in emails within your own inbox)
When you click on one of these links and the webpage is deemed malicious, you will also see a warning message that prompts you to navigate away from the site.
What do I do if I see a phishing email in my inbox?
When you see a suspicious email, you can use the Report Message function and mark is as Junk or Phishing in Outlook and Exchange Online.
What do I do if I am blocked from accessing a legitimate website?
Please send email to cchelp@ust.hk to report any false positives, a white list is available to help manage URLs that should not be scanned.