Automatic check of links in emails

Question

Hello everyone.
Found some issue related to Exchange O365.
Upon receipt of the letter, the links in the letter are checked by something from the O365 cloud (the ip-addresses of those who have passed through them from the MSFT range)

If you do not open the letter, or even close any email clients, "something" will still check the link in the incoming letter.

Is this "something" perhaps a defender? Tell me where you can see and check?

The problem is that the company uses a phishing awareness system. And from time to time, the information security department sends letters with links by clicking on which information security officers will understand that the user did not recognize the phishing letter and still clicked on the link.
But since "something" follows the links first (I repeat, even with a closed letter and even an email client), it is impossible to carry out such work at the moment, because the following links will be about 100% :)

Answer 1

The Sec Dept can create a policy in Defender to exclude phishing awareness programs:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-worldwide

Answer 2

Can you mention the phishing system that your org is using?

If its defender for office365 anti-phishing policies, you can exclude the sec department from the policies, just edit the policies if you have more than one, as mentioned by @Andy David - MVP

Microsoft defender for office365 uses safe links policies to scan links shared in emails messages or documents, if you have one set then exclude the sec department.

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links?view=o365-worldwide

Office 365 comes with Default connection filtering policy, that checks IP that are allowed or disallowed to connect to your exchange online. This policy has a Microsoft safe list a dynamic allow list (IP Ranges )managed by Microsoft themselves, if that feature is enabled, then IPs that Microsoft regards as unsafe can same thing.

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-the-connection-filter-policy?view=o365-worldwide

You can take a look on all security reports centric to emails or other workloads, you need first to login to your tenant.
https://security.microsoft.com/securityreports

Answer 3

Bypassing Safe Link and Safe Attachments in Office 365
This worked for us! We had the same issue while testing our phishing campaigns from a 3rd party external sender.

1. Go to Exchange Online -> Mail flow > Rules.
2. Create a new rule from scratch, Add and then select Create a new rule.
3. In the New rule dialog box, name the rule, and then select the conditions and actions for this rule:
4. In Apply this rule if…, select the condition you want from the list of available conditions.
5. Some conditions require you to specify values. For example, if you select The sender is… condition, you must specify a sender address. If you are adding a word or phrase, note that trailing spaces are not allowed.
6. If the condition you want is not listed, or if you need to add exceptions, select More options. Additional conditions and exceptions will be listed.
7. If you do not want to specify a condition and want this rule to apply to every message in your organization, select [Apply to all messages] condition.
8. In Do the following…,
9. Select Modify the message properties, then choose Set the message header to this value (If the condition is not listed, select More options. Additional conditions will be listed.)
10. In the first enter text field enter X-MS-Exchange-Organization-SkipSafeLinksProcessing
11. In the second enter text field enter 1

This article tells you how to bypass those automatic checks by setting headers in your Exchange Online mail flow rule
https://www.pei.com/bypass-safe-link-attachments-office-365/

best regards,
Mihai