Block URL from opening in already delieverd e-mail in Outlook

Question

Block URL from opening in already delieverd e-mail in Outlook

Tonito Dux 976

Hi,

today we had a very good spoofed e-mail which tricked our colleagues into giving their e-mail and password to the spammer. Fortunately, 90% of the company is still on vacation.

The phishing leads the users to click on a photo which is then linked to a link with our company name but naturally, totally different with the odoo.com domain at the end which we do not use.

The URL goes like this https://our-company-name.odoo.com/. I want to block the link in Microsoft 365 Defender under "Tenant Allow/Block lists" -> URL. But everything i tried to enter does not work! I am missing a syntax and maybe a license for O365. We have only E3 without "Enterprise mobility + security". But the option to block the URL is still there.

What/how should I write the link that I want here:

Cheers

Lu Dai-MSFT 28,501 Reputation points

2022-01-06T00:54:49.017+00:00

@Tonito Dux Thanks for posting in our Q&A. For this issue, it is not related to windows 365. To get accurate help, I will remove windows 365 tag. Thanks.

Accepted answer

5 additional answers

Your answer

Lu Dai-MSFT 28,501 Reputation points

2022-01-06T00:54:49.017+00:00

@Tonito Dux Thanks for posting in our Q&A. For this issue, it is not related to windows 365. To get accurate help, I will remove windows 365 tag. Thanks.

Answer 1

Andy David - MVP 157.8K MVP Volunteer Moderator

Enabling MFA/2FA is the best thing you can do.
I would also check your config:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide

Tonito Dux 976 Reputation points

2022-01-11T19:06:13.063+00:00

Hi Andy,

since you want to help, do you mind answering the following question. Does the EOP also monitor inside mail traffic? If not what would we have to buy in order to have this part covered as well? because we had an internal phishing attack and our TrendMicro Antivirus missed it as well. Explanation from TM is that their AV does not cover e-mails.
Only thing which was not enabled, as far as i know was this safe links policy, but not the whole policy but the setting to "Apply Safe Links to email messages sent within the organization" - this was off at the time.

Thank you
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2022-01-11T20:31:59.213+00:00

EOP is for internet mail, not for strictly internal mail.
Internal mail is authenticated between users so its not quite the same but anti-malware is checked there of course as well you can use transport rules to block attachments etc...

Using Safe Links within the org is a good move - but really user education and MFA/2FA is a must of course...

You can also use Sentinel, Defender and alerts to shore things up:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer?view=o365-worldwide
Tonito Dux 976 Reputation points

2022-01-11T20:57:19.297+00:00

Thank You Andy,

you have helped me very much. MFA E-Mail is going out tomorrow to the colleagues and they have to implement it within one week.
I will take a look at the link provided, there is much to read which is good-that means many options to set up.

Cheers,

Answer 2

Andy David - MVP 157.8K MVP Volunteer Moderator

I would enter:
our-company-name.odoo.com

Answer 3

Hi @Tonito Dux ,

Welcome to our forum!

According to your description, I have created block URL entries in the Tenant Allow/Block List and can block the emails with URL successfully. Agree with AndyDavid, you just need to enter our-company-name.odoo.com when you enter to add the URL.

On the other hand, it is also recommended that you could add the sender of this message to the block sender to prevent receiving spoofed e-mails sent by this sender again. Please click Home > Delete group > Junk > Junk E-mail Options>Blocked Senders>Add and enter the sender's email address.

Hope the above help!

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Andy David - MVP 157.8K MVP Volunteer Moderator

What URL did you enter?
Did you follow:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#url-syntax-for-the-tenant-allowblock-list

Tonito Dux 976 Reputation points

2022-01-05T19:06:00.037+00:00

Hi Andy,

actually I did read the article before posting, and I have entered couple of links with diff. syntax but I think I know what is the issue. I am testing the link with my test user which is in a another OU an does not have the same rights as a normal user. Just now I clicked on the link with my user and the link was blocked! So it takes up to 5min for the setting to apply.

I think that this "success" was create over "Safe Link"-> Global settings, so it doesn't come from the tenant section.

Would you be so kind and tell me what would YOU enter according to this https://our-company-name.odoo.com/ link? This is how the link looks like but of course I have changed the company name, but odoo.com is real.

Cheers

Answer 5

Tonito Dux 976

Hi,

thank you all for your help. I cannot determine what works for this link in question: the safe links global settings or tenant/allow block option. I have a feeling that it takes a long time for a setting to apply to clients (does somebody know the time, i read somewhere in the docs up to 30min?)

This is the screen that shows up:

As a test, I entered dell.com 15-20min ago together with some other sites, but it is not blocking them:

Cheers

ChristyZhang-MSFT 26,126 Reputation points Microsoft External Staff

2022-01-07T05:32:03.157+00:00

Hi @Tonito Dux ,

Thanks for your reply!

I don't think it takes a long time to apply to the client. It takes effect immediately in my test. Can you successfully block URLs from outside the organization according to the steps and screenshots I provide? As I know, it doesn’t work in intra-org messages.
Tonito Dux 976 Reputation points

2022-01-07T08:01:50.113+00:00

Hi,

i just found out what was the issue. My apologizes, the thing works but only if I send the link in the e-mail! I was thinking that tenant block/allow was to block the WHOLE URL in the browser without clicking in any e-mail. To further explain, I thought that the block URL option would really forbid all users to access for example facebook.com but this is not possible as far as MS support told me couple of minutes ago.

In order to block the webpage I have use our antivirus software.

Important question: if we have an phising scam that comes from our internal colleague, how do we proceed then? How do we block the link internally in Defender?

Cheers
ChristyZhang-MSFT 26,126 Reputation points Microsoft External Staff

2022-01-10T06:12:48.363+00:00

Hi @Tonito Dux ,

Thanks for your reply!

As I mentioned above, this setting can only be applied to messages received from outside. In addition, you can also take a look at what Andy David mentioned.

By the way, if you think a reply is helpful to you, it is recommended that you try to mark the helpful answer as the answer so that other users with similar questions can get reference. Warm thanks!
Tonito Dux 976 Reputation points

2022-01-10T09:05:26.253+00:00

Hi Christy,

what do we need to do in order to have the message/link scanned from the internal side. This was an attack from the inside. The hacker gained our colleagues password and was able to login as her and send e-mail. Unfortunately, only some of us have 2FA enabled-think this will change very fast this week. Do we need to buy some other product from Microsoft? I want a solution that covers all devices (endpoint is coming to E3 soon) but this internal traffic is bothering me.
I also discovered that in the safe links options, the option "Apply Safe Links to email messages sent within the organization" was disabled, now it is enabled.

Cheers!

Share via

Block URL from opening in already delieverd e-mail in Outlook

5 additional answers

Your answer