Features
At a high level, here's how Safe Links protection works on URLs in email messages:
- All email goes through EOP, where internet protocol (IP) and envelope filters, signature-based malware protection, anti-spam and anti-malware filters before the message is delivered to the recipient's mailbox.
- The user opens the message in their mailbox and clicks on a URL in the message.
- Safe Links immediately checks the URL before opening the website:
- If the URL is included in the Block the following URLs list, a blocked URL warning opens.
- If the URL points to a website that has been determined to be malicious, a malicious website warning page (or a different warning page) opens.
- If the URL points to a downloadable file, and the Apply real-time URL scanning for suspicious links and links that point to files setting is enabled in the policy that applies to the user, the downloadable file is checked.
- If the URL is determined to be safe, the website opens.
User Experience
Warning pages from Safe Links
This section contains examples of the various warning pages that are triggered by Safe Links protection when you click a URL.
Note that several warning pages have been updated. If you're not already seeing the updated pages, you will soon. The updated pages include a new color scheme, more detail, and the ability to proceed to a site despite the given warning and recommendations.
Scan in progress notification
The clicked URL is being scanned by Safe Links. You might need to wait a few moments before trying the link again.
Suspicious message warning
The clicked URL was in an email message that's similar to other suspicious messages. We recommend that you double-check the email message before proceeding to the site.
Phishing attempt warning
The clicked URL was in an email message that has been identified as a phishing attack. As a result, all URLs in the email message are blocked. We recommend that you do not proceed to the site.