Teams Real Simple with Pictures: Setting up Safe Links for Teams

It's nearly here. The big day. My 5 year old is still building his Christmas list and wanting half of the things he sees on TV. It's fingers crossed that the turkey will still be there when we go to pick it up at Mark's and Spencer's on Thursday. And of course we all hope that we'll get to see our loved ones over the festive season given what's happening with Omicron here in the UK. But for now, let's put all the worries aside and focus on something we can control and do something about pretty quickly: which is implementing Safe Links for Microsoft Teams. It's something easy to do, and the security benefits are 101. It's all about protecting users from clicking on malicious URL's directing them to sites aiming to instigate a data breach, or triggering the download of a payload onto their device. Given that Teams has open federation by default its pretty much a no brainer. I tend to think of it this way: what if someone who you regularly chat with in private from another organisation sends a link which you don't recognise? How do you know that person hasn't been breached? So how do you respond to someone you don't know? What if someone who has been breached within your organisation sends you a document link within Teams with a malicious URL inside of it which to all extents looks like a legitimate business document? Now, I would love to say that everyone I know - myself included - exercises good judgement in these matters one hundred percent of the time. However, let's be honest this just isn't true. This is why zero trust is so important to everything we do moving forward. Chances are, someone will click the link. And it's not because they are stupid. It's often because they are busy, or under pressure, or the attackers are very good at making the URL look legit. How many of us ask somebody to ratify a URL before clicking on it? It could be a combination of those things and it could happen to any of us. Safe Links is included in Defender for Office 365 Plan 1. It's in E5 but also a standalone SKU which could be added, for example to Microsoft 365 Business Premium. It's important to note that everyone who you intend to protect with this needs to be licensed. If the licence isn't on, it won't work even if you add the user to the policy.