CIS.M365.2.1.1: Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.2.1.1
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Defender
Related products	Exchange Online
Feature	Safe Links
Security area	Email and collaboration protection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 2.1.1 (L2, E5 Level 2)
Framework controls	cis-m365:2.1.1 nist-800-53-r5:SI-3 Malicious Code Protection
MITRE ATT&CK	T1566.002, T1204.001
Reads from	Exchange Online, Microsoft Graph, Security & Compliance PowerShell
Licence needed	ATP_ENTERPRISE

What this checks and how to fix it

2.1.1 (L2) Ensure Safe Links for Office Applications is Enabled

Enabling Safe Links policy for Office applications allows URL’s that exist inside of Office documents and email applications opened by Office, Office Online and Office mobile to be processed against Defender for Office time-of-click verification and rewritten if required.

Note: E5 Licensing includes a number of Built-in Protection policies. When auditing policies note which policy you are viewing, and keep in mind CIS recommendations often extend the Default or Built-in Policies provided by MS. In order to Pass the highest priority policy must match all settings recommended.

Rationale

Safe Links for Office applications extends phishing protection to documents and emails that contain hyperlinks, even after they have been delivered to a user.

Impact

User impact associated with this change is minor - users may experience a very short delay when clicking on URLs in Office documents before being directed to the requested site. Users should be informed of the change as, in the event a link is unsafe and blocked, they will receive a message that it has been blocked.

Remediation action

To create a Safe Links policy:

1. Navigate to Microsoft 365 admin center https://admin.microsoft.com.
2. Under Email & collaboration select Policies & rules
3. Select Threat policies then Safe Links
4. Click on +Create
5. Name the policy then click Next
6. In Domains select all valid domains for the organization and Next
7. Ensure the following URL & click protection settings are defined:

Email

• Checked On: Safe Links checks a list of known, malicious links when users click links in email. URLs are rewritten by default
• Checked Apply Safe Links to email messages sent within the organization
• Checked Apply real-time URL scanning for suspicious links and links that point to files
• Checked Wait for URL scanning to complete before delivering the message
• Unchecked Do not rewrite URLs, do checks via Safe Links API only.

Teams

• Checked On: Safe Links checks a list of known, malicious links when users click links in Microsoft Teams. URLs are not rewritten.

Office 365 Apps

• Checked On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office apps. URLs are not rewritten

Click protection settings

• Checked: Track user clicks
• Unchecked: Let users click through the original URL
• There is no recommendation for organization branding

8. Click Next twice and finally Submit.

PowerShell

1. Connect using Connect-ExchangeOnline.
2. Run the following PowerShell script to create a policy at highest priority that will apply to all valid domains on the tenant:

# Create the Policy
$params = @{
    Name                     = "CIS SafeLinks Policy"
    EnableSafeLinksForEmail  = $true
    EnableSafeLinksForTeams  = $true
    EnableSafeLinksForOffice = $true
    TrackClicks              = $true
    AllowClickThrough        = $false
    ScanUrls                 = $true
    EnableForInternalSenders = $true
    DeliverMessageAfterScan  = $true
    DisableUrlRewrite        = $false

}
New-SafeLinksPolicy @params
# Create the rule for all users in all valid domains and associate with Policy
New-SafeLinksRule -Name "CIS SafeLinks" -SafeLinksPolicy "CIS SafeLinks Policy" -RecipientDomainIs (Get-AcceptedDomain).Name -Priority 0

Related links

• Microsoft 365 Admin Center
• Set-SafeLinksPolicy
• Set up Safe Links policies in Microsoft Defender for Office 365
• Preset security policies in cloud organizations
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 78

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: NZLostboy; contributors: Mynster9361. Open-source licences.