Module 3 of 6

🎯 Security Course · Module 3 of 6

Safe Links, Safe Attachments & Quarantine Management

📂 Course: M365 Security Administration
📦 Module: 3 of 6
🎯 Exam: SC-200
⏱ Read time: ~20 min

SC-200 Exam Alignment
SC-200

Mitigate threats using Defender for Office 365: Configure Safe Links URL protection, Safe Attachments detonation policies, per-workload attachment scanning (SharePoint, OneDrive, Teams), and manage the quarantine workflow for end-users and admins.

Safe Links rewrites URLs at delivery time and rechecks at click time — this is time-of-click protection and catches URLs that were clean at delivery but later turned malicious
Safe Attachments detonates files in a virtual sandbox — the detonation mode (Dynamic Delivery vs Block) determines whether the user can read the email body while the attachment is being scanned
Safe Attachments for SharePoint, OneDrive, and Teams is a separate toggle from the Safe Attachments policy for email — it must be enabled independently
Quarantine default retention is 30 days — messages are permanently deleted after this period; admins can review, release, or block senders from quarantine

Exam Tip: Know the difference between Safe Attachments delivery modes. Dynamic Delivery sends the email body to the user immediately while the attachment is scanned in the sandbox — the attachment is replaced with a placeholder and reattached after a clean verdict. Block holds the entire message (body and attachment) until scanning completes. For business scenarios where users need to read emails immediately, Dynamic Delivery is the correct answer.

Safe Links and Safe Attachments are Defender for Office 365 Plan 1 features that add a detonation layer on top of EOP’s signature-based scanning. Together they protect against zero-day threats — malicious URLs that become weaponised after delivery, and novel malware files that signature engines haven’t seen yet.

🔗 Safe Links

Safe Links rewrites every URL in inbound emails (and optionally in Teams messages and Office documents) at delivery time. When the user clicks a link, Safe Links performs a real-time reputation check of the destination URL at that exact moment and blocks access if the URL is now classified as malicious.

How Safe Links Works — Step by Step

Step	What Happens
1. Delivery	Email arrives and passes EOP filtering. Safe Links rewrites all URLs to point to Microsoft’s scanning proxy (typically safelinks.protection.outlook.com)
2. User clicks	The browser sends the click through Microsoft’s proxy, which performs a real-time reputation check of the original destination URL
3a. URL is clean	User is transparently redirected to the original URL — the process takes milliseconds
3b. URL is malicious	User sees a red warning page: “This website has been blocked by your organisation.” The click and block event are logged in the URL trace report

Safe Links Policy Settings

Setting	Recommended Value	Notes
Action for unknown potentially malicious URLs	On — URLs are rewritten and checked at click	Core setting — must be enabled for protection to activate
Action for Microsoft Teams URLs	On — check URLs in Teams messages	Separate toggle; requires MDO P1
Apply real-time URL scanning for suspicious links	On	Triggers deeper detonation for suspicious URLs rather than just reputation check
Apply Safe Links to email messages sent within the org	On	Protects against internal phishing from compromised accounts
Do not track when users click links	Off (i.e. track clicks)	URL click data in Threat Explorer is essential for incident investigation
Do not let users click through to original URL	On (for strict targets)	Prevents override of the block warning page by the user

📎 Safe Attachments

Safe Attachments detonates email attachments in an isolated virtual machine (sandbox) to detect malware that doesn’t match any known signature. This protects against zero-day exploits hidden in Office files, PDFs, executables, and archives.

Safe Attachments Delivery Modes

Mode	Behaviour	Use Case
Dynamic Delivery	Email body delivered immediately with a placeholder attachment. Attachment is scanned in sandbox and reattached after a clean verdict. If malicious, the attachment is replaced with an alert	Best for most users — minimal disruption, maximum protection
Block	Entire message (body + attachment) held in quarantine until scanning completes. Clean messages are released; malicious messages are quarantined	High-security environments where delay is acceptable (e.g. finance teams)
Replace	Delivers the message immediately but replaces the attachment with a notice that scanning is in progress. Reattaches if clean	Legacy mode — Dynamic Delivery is preferred
Off	No detonation — Safe Attachments is disabled for this policy	Not recommended unless explicitly excluded for performance reasons

Safe Attachments for SharePoint, OneDrive, and Teams

💡 Separate Toggle — Must Be Explicitly Enabled

Safe Attachments protection for SharePoint Online, OneDrive for Business, and Microsoft Teams is a separate feature from the email Safe Attachments policy. It is enabled globally in the tenant settings (not per-policy). When enabled, files uploaded to SharePoint and OneDrive are asynchronously scanned in a sandbox. If a file is found to be malicious, it is locked — users see a warning and cannot download or share the file until an admin reviews it.

To enable: security.microsoft.com → Email & collaboration → Policies & rules → Threat policies → Safe Attachments → Global settings → Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams

🗂️ Quarantine Management

The quarantine holds messages that were blocked by EOP or MDO policies. Admins can review, release, delete, or report quarantined messages. Depending on policy settings, end-users may also be able to view and release messages quarantined as spam.

Who Can Access	What They Can See/Do	Location
Admins	All quarantined messages across the tenant — can preview, release to recipient, delete, download for analysis, block sender	security.microsoft.com → Email & collaboration → Review → Quarantine
End users	Only their own quarantined messages — can release spam, request release of phish (if policy allows). Cannot see other users’ quarantine	security.microsoft.com (user view) or Quarantine Digest email notification

Quarantine Policies

Quarantine policies (formerly “end-user spam notifications”) define what end-users can do with their quarantined messages. Assign quarantine policies to threat policies (anti-spam, anti-phishing, Safe Attachments) separately.

Built-in Policy	End-User Access	Assign To
AdminOnlyAccessPolicy	Users cannot see or release these messages — admin-only	High confidence phish, malware, Safe Attachments blocks
DefaultFullAccessPolicy	Users can view, release, delete, and block sender for their own quarantined messages	Spam, bulk email
NotificationEnabledPolicy	DefaultFullAccess + quarantine notification emails sent to users on a schedule	Spam, bulk — when you want users to proactively manage their spam

PowerShell — Safe Attachments & Quarantine

💡 Best Practices

Use Dynamic Delivery for Safe Attachments for most users — it minimises disruption while providing full sandbox detonation protection
Enable Safe Attachments for SharePoint, OneDrive, and Teams — this is often overlooked and is one of the highest-impact settings for collaboration security
Configure Safe Links to track all URL clicks — the URL trace report in Threat Explorer is essential for investigating incidents where a user may have clicked a malicious link
Assign AdminOnlyAccessPolicy to quarantine actions for high confidence phishing and malware — users should never self-release these categories without admin review
Set up quarantine notifications (via NotificationEnabledPolicy) for spam so users can manage their own bulk mail without contacting the helpdesk

🎓 Interview Q&A

Q: A user receives a phishing email containing a malicious URL. The URL was clean at the time of delivery (reputation was not yet updated), but the attacker made it malicious 2 hours later. The user clicks the link 3 hours after receiving the email. What MDO feature ensures the user is blocked from visiting the now-malicious URL?

Safe Links time-of-click protection. Even though the URL appeared clean when the email was delivered and passed EOP/MDO detonation, Safe Links rewrites the URL at delivery and performs a fresh, real-time reputation check at the moment of click. When the user clicks 3 hours later, Safe Links checks the current reputation of the destination URL — which is now classified as malicious — and blocks the user with a warning page. This time-of-click protection specifically addresses the “retroactive malicious URL” attack pattern where attackers keep URLs clean during delivery and only activate the payload later. This is why disabling URL tracking is risky — without click data you cannot know which users clicked and when.

🎯 SC-200 Mock Test

Module 3 — Safe Links, Safe Attachments & Quarantine

5 questions · Scenario-based · Pass mark: 70%

Q1 of 5

Users in the Finance department need to receive emails with attached PDFs and process them immediately without waiting for attachment scanning. Which Safe Attachments delivery mode should be configured for these users?

ABlock — hold all messages until scanning completes

BDynamic Delivery — delivers the email body immediately with a placeholder; reattaches the PDF after a clean verdict

COff — disable Safe Attachments for Finance to remove the delay

DReplace — substitutes the PDF with a notice and never reattaches it

✅ B. Dynamic Delivery is the correct mode. It delivers the email body to the user immediately (they can read the message and see the sender/subject) while the attachment is simultaneously detonated in a sandbox. A placeholder is shown in place of the PDF. Once scanning completes — typically within minutes — the PDF is reattached if clean. If malicious, the placeholder remains. This balances user productivity with full detonation protection.

Q2 of 5

An administrator has configured a Safe Attachments policy for all users with Dynamic Delivery mode. A user uploads a malicious Excel file to a SharePoint document library. Will Safe Attachments protect against this?

AYes — the email Safe Attachments policy automatically extends to SharePoint uploads

BYes — SharePoint has its own built-in malware scanner that catches this without any MDO configuration

CNo — SharePoint protection requires the global “Safe Attachments for SharePoint, OneDrive, and Teams” setting to be separately enabled

DNo — SharePoint files are never scanned regardless of MDO settings

✅ C. Safe Attachments protection for SharePoint, OneDrive, and Teams is a separate global toggle from the email Safe Attachments policy. Even if email Safe Attachments is configured and active, SharePoint uploads are NOT covered unless the global setting “Enable Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams” is explicitly turned on. This is a common exam trap — and a real-world security gap that admins miss.

Q3 of 5

A user reports they clicked a link in an email 4 hours ago and it worked fine, but they are now seeing a Safe Links warning page when clicking the same link. What is the most likely explanation?

AThe URL was clean at first click but was later reclassified as malicious — Safe Links’ real-time check now blocks it at click time

BThe user’s browser cache is corrupted and needs to be cleared

CSafe Links was only just enabled — it retroactively blocks previously clicked URLs

DThe user’s account has been flagged as a risky user and all URL clicks are being blocked

✅ A. This is the Safe Links time-of-click protection scenario. The URL was not malicious 4 hours ago (first click worked fine), but the attacker later weaponised the destination. When the user clicks again now, Safe Links performs a fresh real-time reputation check and finds the URL is now malicious — blocking the visit. This is exactly the threat pattern Safe Links is designed to catch and illustrates why time-of-click protection is superior to only checking URLs at delivery time.

Q4 of 5

A message was quarantined as high confidence phishing. The user wants to release it themselves, but the quarantine portal shows them a “Request release” option rather than a “Release” button. Why?

AThe user has a Reader role — they must upgrade to Contributor before releasing quarantined messages

BThe message is older than 7 days and can no longer be released without PowerShell

CThe user’s mailbox is over quota — they must clear space before releasing quarantined messages

DThe quarantine policy assigned to high confidence phishing is AdminOnlyAccessPolicy — users cannot self-release phishing messages; they can only request an admin release

✅ D. The AdminOnlyAccessPolicy quarantine policy restricts end-user actions on high confidence phishing (and malware) quarantined messages to “Request release” — users can flag it for admin review but cannot self-release. This is a security control: if a user received a convincing phishing email they believe is legitimate, they might self-release a genuinely dangerous message. Requiring admin approval adds an expert review layer before potentially dangerous content reaches the mailbox.

Q5 of 5

What is the default quarantine message retention period in Exchange Online Protection before messages are permanently deleted?

A7 days

B15 days

C30 days

D90 days

✅ C. 30 days. Quarantined messages are held for 30 days by default and then permanently deleted. This retention period can be configured per quarantine policy between 1 and 30 days. Admins must review and release or export important quarantined messages within this window or they are lost permanently. This is why routine quarantine review (at least weekly) is a security best practice.