Safe Links and URL Detonation

Question

Hello,

I am trying to perform phishing tests on my users for the first time. After the first test was over, the results showed that a majority of the clicks were originating from URL detonation in Microsoft Defender. I can't seem to find a way to create an exclusion that ignores the URL in the phishing email. I looked at the Safe Links threat policy and there was a setting for "Do not rewrite the following URLs in email".

If I specify the URL that I don't want Safe Links to rewrite, will that prevent URL detonation in the phishing emails?

If not, is there a way to exclude the phishing emails from URL detonation in Defender?

Thank you.

Answer 1

Hi Ojii-San 2.0,
I'm hopeful that I've received a resolution to my issue after reaching out to our Security Awareness Training platform provider.
We are not using the native MS Defender Phishing Simulator, we us KnowBe4.

Having raised a Ticket with KnowBe4 support, and chatting with them, it appears that we'd missed off a number of KnowBe4 Domains that needed Whitelisting in our MS Defender Advanced Delivery Policy.

Having followed guidance from here (KnowBe4 - Whitelist Mail Servers - Microsoft), and with assistance from a KnowBe4 Support Representative, we've configured the following:

• Advanced Delivery Policies in Microsoft Defender for Office 365
• Whitelist Phish Link and Landing Page Domains in Microsoft Defender SmartScreen
• Bypass Safe Link and Safe Attachments in Microsoft Defender for Office 365
• MS Defender for Endpoint - Create indicators for IPs and URLs/domains

This appears (after testing) to have resolved our issues.

Good luck 🤞 with your continued search in resolving the issues you are experiencing, and hopefully the above might help.

Thanks
Kind Regards
Matt Bell

Answer 2

Ok, will do. Thanks for responding, Reynaldo.

Answer 3

Hi Ojii-San 2.0

Thanks for getting back.

To better assist you with this, at this point, it would be best if you contact our in-app support on Microsoft Defender. You can reach out to them by signing in your account on the Microsoft Defender website then navigate the question mark(?) at the upper right corner. Type in your issue, then click on the Contact Support button at the bottom.

I appreciate your understanding.

Sincerely,

---

ReynaldoB

Microsoft Community Forum Moderator

Answer 4

Hi Reynaldo,

Thank you for your response. Two things:

1. Domains and IP addresses that phishing test emails will originate from should be specified in the Advanced Delivery rules under Microsoft Defender for Office threat policies. According to this article, Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes, Advanced Delivery is supposed to prevent URL detonation as stated, "Use the advanced delivery policy in EOP to prevent inbound messages in these specific scenarios from being filtered¹. The advanced delivery policy ensures that messages in these scenarios achieve the following results: ... Safe Links in Defender for Office 365 doesn't block or detonate the specified URLs in these messages at time of click. URLs are still wrapped, but they aren't blocked..." It seems Advanced Delivery doesn't work to prevent URL detonation during mail flow. Shouldn't it though?
2. I also found information that adding allow entries to the Tenant Allow/Block List will prevent URL detonation during the mail flow. Is this confirmed to be the correct way to prevent URL detonation on URLs in my phishing tests entirely?

Thank you.

Answer 5

Hello Ojii-San 2.0,

Thank you for reaching out to us with your concern.

I understand that you are experiencing issues with URL detonation in Microsoft Defender while performing phishing tests on your users. I couldn't imagine the inconvenience you are experiencing right now.

Microsoft Defender for Office 365 uses Safe Links to provide URL scanning and rewriting of inbound email messages during mail flow, and time-of-click verification of URLs and links in email messages. If you specify a URL in the “Do not rewrite the following URLs” setting, it should prevent Safe Links from rewriting that URL. However, this does not necessarily mean it will prevent URL detonation.

For exclusions in Microsoft Defender, you can define exclusions for certain entities. However, these exclusions are typically for files, folders, or processes that aren’t actually a threat but are detected as malicious by Defender. It’s important to note that defining exclusions reduces the level of protection offered by Defender.

To manage exclusions for URLs/Domains in Microsoft Defender SmartScreen, you can follow these steps:

1. Open Microsoft Defender portal
2. In the left menu, scroll down and click on settings
3. Click now on Endpoints in the main page
4. In the 2nd menu (submenu), scroll down to Rules
5. Click on indicators
6. Now you must click under indicators on URLs/Domains

Please note that these steps are for Microsoft Defender SmartScreen and may not apply directly to your situation with phishing emails and URL detonation in Defender. Remember, any changes to security settings should be done with caution as they can potentially reduce the level of protection.

You may refer to this link for more information. Set up Safe Links policies in Microsoft Defender for Office 365 | Microsoft Learn

Sincerely,

---

ReynaldoB

Microsoft Community Forum Moderator