Safe Links (mail edition)
URLs are wrapped/checked so the verdict happens AT CLICK TIME — the crucial property against delayed weaponisation (clean at delivery, armed an hour later; ZAP's cousin for links). Policy knobs that matter: applied-to scoping, internal-mail coverage (on — internal compromise is the BEC amplifier), the click-through allowance (OFF for a real security posture; 'warn but allow' is a compliance checkbox pretending), and per-message URL trace visibility for IR. The Teams-side coverage shares the policy family (the Teams curriculum's Safe Links concept) — one design, two surfaces.
Safe Attachments (mail edition)
Unknown attachments detonate in sandboxes before delivery completes. The latency decision is the real design choice:
- Block (default posture): mail waits for the verdict — seconds to low minutes of added delivery latency on attachment-bearing mail. Correct for most.
- Dynamic Delivery: body delivers immediately with a placeholder attachment; the real file swaps in post-verdict — latency hidden from users, complexity added (re-attach edge cases).
- Monitor: deliver + track — a migration/tuning mode, not an end state.
Gaps to know cold: password-protected archives (undetonatable — policy the human workflow instead), very large files (size caps), and cloud-link laundering (the attachment is a SharePoint link — Safe LINKS' jurisdiction, which is why the two ship as a pair).
What to watch (proofs)
- Policy census: Get-SafeLinksPolicy / Get-SafeAttachmentPolicy | fl — scoping, click-through stance, delivery mode; drift on click-through allowance is posture drift, alert-worthy.
- The latency you're spending: delivery-time delta for attachment-bearing mail (trace timestamps) — the Dynamic Delivery business case, measured not asserted.
- Detonation catches: Threat Explorer filtered to Safe Attachments/Links verdicts — the engines' actual yield, and the fodder for 'is this worth the licence' reviews.
- Click-through audits (if allowed anywhere): who clicked through warnings (URL trace) — each row is either training fodder or the argument to turn the allowance off.