If your Microsoft 365 plan includes Defender for Office 365, you already have Safe Links and Safe Attachments. The question is which version of them is protecting your staff. Most tenants run on the Built-in protection that Microsoft applies automatically, and never move to the Standard or Strict presets. Choosing the right Safe Links Safe Attachments policy setup is one of the quickest email security wins available.
This article explains the three preset levels, the exact settings that differ, and how to decide who gets what.
What Safe Links and Safe Attachments do
Safe Links checks URLs when a user clicks them, not just when the message arrives. That matters because attackers often send a clean link and turn it malicious hours later. Safe Links covers email, and also links in Microsoft Teams and Office apps when configured.
Safe Attachments opens file attachments in a virtual environment to see what they do before the message is delivered. Microsoft calls this detonation. It catches new malware that signature-based scanning has not seen yet.
Both features are part of Microsoft Defender for Office 365 Plan 1, which is included in Microsoft 365 Business Premium and available as an add-on for other plans. Plan 2 (included in E5) adds investigation and response tools, including attack simulation training.
The three preset levels
Microsoft offers preset security policies so you do not have to configure hundreds of settings by hand. You find them in the Defender portal at Email & collaboration > Policies & rules > Threat policies > Preset security policies.
Built-in protection: applied to all recipients by default. It provides Safe Links and Safe Attachments only. It is the safety net for anyone not covered by another policy.
Standard protection: a baseline Microsoft recommends for most users. It covers Safe Links and Safe Attachments plus anti-spam, anti-malware, and anti-phishing, including impersonation protection.
Strict protection: a more aggressive version for high-value targets, such as executives, finance staff, and admins.
Until you assign users to Standard or Strict, those presets apply to nobody. In the tenants I review, that is the most common state: Built-in protection only, with impersonation protection never switched on.
Built-in vs Standard and Strict: the Safe Links differences
For Safe Attachments, Microsoft states there is no difference between Built-in protection and the Standard or Strict presets. The real differences are in Safe Links:
Safe Links setting
Built-in protection
Standard and Strict
Let users click through to the original URL
Allowed
Not allowed
Do not rewrite URLs, check via Safe Links API only
On (no rewriting)
Off (URLs are rewritten)
Apply Safe Links to messages sent within the organization
Off
On
Each of these matters in practice.
Click-through
With Built-in protection, a user who sees a warning page can click through to the malicious site anyway. Under Standard and Strict, they cannot. People click through warnings when they are busy, so removing that option is a real improvement.
Internal messages
Built-in protection does not scan links in mail sent between your own users. That leaves a gap exactly when it hurts most: after one mailbox is compromised, the attacker sends phishing links to colleagues from a trusted internal address. Standard and Strict close that gap.
URL rewriting
Rewriting replaces links with a Safe Links wrapper so the check happens at click time in every client. Some people dislike the longer URLs, but the protection is more consistent.
Where Strict goes further than Standard
Standard and Strict share the same Safe Links and Safe Attachments behavior. Strict is more aggressive in the other parts of the stack: anti-phishing thresholds, spam and bulk mail handling, and quarantine actions. In general, Strict quarantines more borderline mail than Standard, while both treat clear malware and high-confidence phishing the same way.
The trade-off is more messages in quarantine for Strict users, and occasionally a legitimate newsletter or marketing email held back. For a managing partner or a CFO, that is usually an acceptable price. For a whole office, it can become noise.
Deciding who gets what
This assignment works well for most 20 to 500 person businesses:
Strict: executives, partners, finance and accounts payable, HR and payroll, and anyone with an admin role. These are the people attackers impersonate and target.
Standard: everyone else. Assign by a group that includes all users, or by your domain.
Built-in protection: leave it in place as the safety net. Do not add exclusions unless a user genuinely lacks a Defender for Office 365 license.
Policies apply in a fixed order: Strict first, then Standard, then custom policies, then Built-in protection. A user in Strict gets Strict settings even if they are also in the Standard group, so you can safely assign Standard to everyone and Strict to a smaller group.
To set it up:
Open Preset security policies in the Defender portal.
Under Standard protection, select Manage protection settings.
Apply Exchange Online Protection and Defender for Office 365 protections to your chosen users, groups, or domains.
On the impersonation step, add your executives as protected users and your own domains as protected domains. Add key suppliers’ domains too.
Repeat for Strict protection with your high-value group.
Review quarantine and user reports for two weeks, then adjust.
Also check that Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is turned on. It is a separate global setting under Threat policies > Safe Attachments > Global settings and is not controlled by the presets.
When custom policies make sense
Presets cover most needs, and Microsoft generally recommends them over custom policies. Custom Safe Links or Safe Attachments policies are worth it when you need something the presets do not offer, such as a specific list of URLs that should never be rewritten for a line-of-business system. If you go custom, document why, because custom policies are the ones that drift.
A common mistake is building a custom policy years ago, assigning it to everyone, and forgetting it exists. Because custom policies apply before Built-in protection, that old policy may be weaker than what Microsoft now offers by default. Review any custom Safe Links and Safe Attachments policies at least once a year and compare them against the current Standard settings.
It is better than nothing, but it allows click-through on malicious links, does not scan internal messages, and does not turn on impersonation protection. Most businesses should apply the Standard preset to all users.
Will the Strict preset block legitimate email?
Occasionally, yes. Strict quarantines more borderline messages, such as bulk mail. Users can be given access to review their own quarantine, and admins can release messages. Apply Strict to a targeted group rather than everyone.
Do I need Defender for Office 365 Plan 2 for Safe Links?
No. Safe Links and Safe Attachments are in Plan 1, which Business Premium includes. Plan 2 adds investigation tools and attack simulation training.
Not sure which preset your users are on? Book a free Microsoft 365 security assessment and we will review your Safe Links, Safe Attachments, and anti-phishing setup.
If your Microsoft 365 plan includes Defender for Office 365, you already have Safe Links and Safe Attachments. The question is which version of them is protecting your staff. Most tenants run on the Built-in protection that Microsoft applies automatically, and never move to the Standard or Strict presets. Choosing the right Safe Links Safe Attachments policy setup is one of the quickest email security wins available.
This article explains the three preset levels, the exact settings that differ, and how to decide who gets what.
What Safe Links and Safe Attachments do
Safe Links checks URLs when a user clicks them, not just when the message arrives. That matters because attackers often send a clean link and turn it malicious hours later. Safe Links covers email, and also links in Microsoft Teams and Office apps when configured.
Safe Attachments opens file attachments in a virtual environment to see what they do before the message is delivered. Microsoft calls this detonation. It catches new malware that signature-based scanning has not seen yet.
Both features are part of Microsoft Defender for Office 365 Plan 1, which is included in Microsoft 365 Business Premium and available as an add-on for other plans. Plan 2 (included in E5) adds investigation and response tools, including attack simulation training.
The three preset levels
Microsoft offers preset security policies so you do not have to configure hundreds of settings by hand. You find them in the Defender portal at
Email & collaboration > Policies & rules > Threat policies > Preset security policies.Until you assign users to Standard or Strict, those presets apply to nobody. In the tenants I review, that is the most common state: Built-in protection only, with impersonation protection never switched on.
Built-in vs Standard and Strict: the Safe Links differences
For Safe Attachments, Microsoft states there is no difference between Built-in protection and the Standard or Strict presets. The real differences are in Safe Links:
Each of these matters in practice.
Click-through
With Built-in protection, a user who sees a warning page can click through to the malicious site anyway. Under Standard and Strict, they cannot. People click through warnings when they are busy, so removing that option is a real improvement.
Internal messages
Built-in protection does not scan links in mail sent between your own users. That leaves a gap exactly when it hurts most: after one mailbox is compromised, the attacker sends phishing links to colleagues from a trusted internal address. Standard and Strict close that gap.
URL rewriting
Rewriting replaces links with a Safe Links wrapper so the check happens at click time in every client. Some people dislike the longer URLs, but the protection is more consistent.
Where Strict goes further than Standard
Standard and Strict share the same Safe Links and Safe Attachments behavior. Strict is more aggressive in the other parts of the stack: anti-phishing thresholds, spam and bulk mail handling, and quarantine actions. In general, Strict quarantines more borderline mail than Standard, while both treat clear malware and high-confidence phishing the same way.
The trade-off is more messages in quarantine for Strict users, and occasionally a legitimate newsletter or marketing email held back. For a managing partner or a CFO, that is usually an acceptable price. For a whole office, it can become noise.
Deciding who gets what
This assignment works well for most 20 to 500 person businesses:
Policies apply in a fixed order: Strict first, then Standard, then custom policies, then Built-in protection. A user in Strict gets Strict settings even if they are also in the Standard group, so you can safely assign Standard to everyone and Strict to a smaller group.
To set it up:
Preset security policiesin the Defender portal.Also check that Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is turned on. It is a separate global setting under
Threat policies > Safe Attachments > Global settingsand is not controlled by the presets.When custom policies make sense
Presets cover most needs, and Microsoft generally recommends them over custom policies. Custom Safe Links or Safe Attachments policies are worth it when you need something the presets do not offer, such as a specific list of URLs that should never be rewritten for a line-of-business system. If you go custom, document why, because custom policies are the ones that drift.
A common mistake is building a custom policy years ago, assigning it to everyone, and forgetting it exists. Because custom policies apply before Built-in protection, that old policy may be weaker than what Microsoft now offers by default. Review any custom Safe Links and Safe Attachments policies at least once a year and compare them against the current Standard settings.
Our Defender for Office 365 service configures presets, impersonation protection, and quarantine policies for you. If you are on a plan without Defender for Office 365, the Microsoft 365 cost calculator shows what adding it would cost, and a Microsoft 365 security assessment checks your current policy assignments. Microsoft’s full comparison is in preset security policies in cloud organizations.
Frequently asked questions
Is Built-in protection enough?
It is better than nothing, but it allows click-through on malicious links, does not scan internal messages, and does not turn on impersonation protection. Most businesses should apply the Standard preset to all users.
Will the Strict preset block legitimate email?
Occasionally, yes. Strict quarantines more borderline messages, such as bulk mail. Users can be given access to review their own quarantine, and admins can release messages. Apply Strict to a targeted group rather than everyone.
Do I need Defender for Office 365 Plan 2 for Safe Links?
No. Safe Links and Safe Attachments are in Plan 1, which Business Premium includes. Plan 2 adds investigation tools and attack simulation training.
Not sure which preset your users are on? Book a free Microsoft 365 security assessment and we will review your Safe Links, Safe Attachments, and anti-phishing setup.