Safe Links and Safe Attachments get mentioned together so often that people assume they’re two names for the same feature. They aren’t. They protect against two different attack types, they trigger at different moments, and they each have settings that catch admins out the first time. One inspects the links in a message; the other inspects the files attached to it.
Both ship as part of Microsoft Defender for Office 365, and both build on top of the anti-malware and anti-spam scanning that Exchange Online Protection already does. This guide explains exactly what each one does, when it kicks in, how to configure the policies, and which Defender plan you need to turn them on.
The short version
If you only remember one thing, make it this:
- Safe Attachments deals with files. It opens (detonates) attachments in an isolated virtual environment and watches what they do before the user can touch them.
- Safe Links deals with URLs. It rewrites links and re-checks them at the moment the user clicks, including in mail that was delivered hours or days ago.
Safe Links vs Safe Attachments at a glance
| Protects against | Safe Links: malicious URLs / Safe Attachments: malicious files |
|---|---|
| How it works | Safe Links: rewrites + re-checks links at click / Safe Attachments: sandbox detonation |
| When it triggers | Safe Links: every click, even post-delivery / Safe Attachments: before/at delivery |
| Main user impact | Safe Links: rewritten URLs, click warnings / Safe Attachments: slight delivery delay |
| Covers beyond email | Safe Links: Teams + Office apps / Safe Attachments: SharePoint, OneDrive, Teams files |
Safe Links: protection that follows the click
The weakness of any one-time scan is timing. An attacker can send a link that points to a clean, reputable page, sail through delivery filtering, then swap the destination to a malware or credential-harvesting site an hour later. By the time the user clicks, the original scan is ancient history.
Safe Links closes that gap with time-of-click protection. When a message arrives, Safe Links rewrites the URLs so they route through a Microsoft checking service. The moment the user clicks — whether that’s two minutes or two weeks after delivery — the real destination is evaluated against current threat intelligence. If it’s now malicious, the user gets a warning page instead of the payload.
A few behaviors worth knowing:
- Rewriting means the link the user sees on hover may show a Microsoft wrapper URL. That’s expected, not a sign of tampering.
- Safe Links can extend beyond email to Microsoft Teams and the Office apps, so a link pasted into a Teams chat or embedded in a Word document gets the same check.
- You can block users from clicking through the warning to a known-bad site, and you can keep a list of URLs that should never be rewritten.
Safe Attachments: open it somewhere safe first
Signature-based malware scanning catches known bad files. It can’t catch a brand-new payload that no one has a signature for yet. Safe Attachments handles that case by detonation: it opens the attachment in an isolated sandbox, watches its behavior, and only delivers it if it behaves harmlessly.
The catch is time — detonation isn’t instant. That’s why the delivery mode matters.
Safe Attachments delivery modes
| Dynamic Delivery | Body delivered immediately; attachment reattached after scanning. Default, best for users. |
|---|---|
| Block | Blocks the message and attachment when detection finds (or suspects) malware. |
| Replace | Strips the attachment and delivers the body with a notification. |
| Monitor | Delivers as normal but logs what detonation found. Useful for tuning. |
Dynamic Delivery is the mode most organizations want. The user gets the email body right away and a placeholder where the attachment will be; once detonation finishes, the real file appears (or a notice that it was removed). Nobody sits staring at an empty inbox waiting for a sandbox to finish.
Safe Attachments isn’t limited to email either. With the global setting enabled, it also checks files in SharePoint, OneDrive, and Microsoft Teams, so a malicious file uploaded to a shared library gets the same treatment.
Setting up the policies
Both features are configured in the Microsoft Defender portal under Email & collaboration → Policies & rules → Threat policies. You can also manage them with the Exchange Online PowerShell module if you prefer scripting or want consistent settings across tenants.
Order of operations
- Confirm you have a Defender for Office 365 license assigned (more on that below).
- Create a Safe Attachments policy: choose the delivery mode (Dynamic Delivery for most), set the recipients/domains it applies to, and enable protection for SharePoint, OneDrive, and Teams if you want it.
- Create a Safe Links policy: enable URL rewriting for email, turn on protection for Teams and Office apps as needed, and decide whether users can click through warnings.
- Use the recipient targeting to scope policies to the right users, and remember that the priority order decides which policy wins if a user matches more than one.
Before you enable Safe Links and Safe Attachments
- Confirm Defender for Office 365 (Plan 1 or 2) licenses are assigned
- Decide your Safe Attachments delivery mode (Dynamic Delivery is the usual choice)
- Identify any internal URLs that must not be rewritten by Safe Links
- Decide whether to extend protection to Teams, SharePoint, and OneDrive
- Set policy priority if users could match multiple policies
- Brief the helpdesk on the slight attachment delay and rewritten link appearance
Licensing: you need Defender for Office 365
This is the part people trip on. Safe Links and Safe Attachments are not part of Exchange Online Protection (EOP), the baseline filtering that comes with nearly every Microsoft 365 plan. They require Microsoft Defender for Office 365, which comes in two plans:
- Plan 1 — includes Safe Links, Safe Attachments, and anti-phishing protection. Focused on prevention.
- Plan 2 — everything in Plan 1, plus investigation and response tooling like Threat Explorer, automated investigation, and attack simulation training.
Defender for Office 365 Plan 2 is included in Microsoft 365 E5. Plan 1 is bundled with some plans and available as an add-on to others. If your Safe Links and Safe Attachments settings exist but never seem to do anything, the first thing to check is whether the affected mailboxes actually have a Defender for Office 365 license assigned.
How they work together
Safe Links and Safe Attachments aren’t competing — they’re two layers covering two different parts of the same email. A phishing message often carries both a malicious attachment and a credential-harvesting link, so you want both checks running. Layer them with EOP’s anti-malware and anti-spam scanning underneath and Defender’s anti-phishing on top, and a single message gets inspected from several angles.
That layering is the whole point of a defense-in-depth approach to email. No single control catches everything, but a malicious attachment that slips past signatures gets caught in detonation, and a link that was clean on arrival gets caught at click time.
Bottom line
Safe Attachments protects files by detonating them in a sandbox before users can open them; Safe Links protects URLs by re-checking them at the moment of click, even in old mail. Both need Defender for Office 365, both extend beyond email into Teams and the Office apps, and both are quickest to deploy through Defender’s preset policies. Use Dynamic Delivery for attachments so users aren’t left waiting, and keep your Safe Links bypass list short.
These two features are core to email defense, but they work best as part of a bigger plan. See how they fit alongside anti-phishing policies, MFA, and authentication records in our guide to protecting Microsoft 365 from phishing, and when you do need to investigate where a suspicious message went, our walkthrough on running a message trace in Exchange Online shows you how.
