4.4.2. Microsoft Defender for Office 365

💡 First Principle: Email remains the single most common initial entry point for attacks, so Defender for Office 365 protects specifically against malicious links and attachments delivered through email and collaboration tools, inspecting content before a user ever has the chance to click something dangerous.

Safe Links rewrites URLs in email and checks them at the moment of click (not just at delivery time), catching links that were safe when the message arrived but were weaponized afterward. Safe Attachments detonates attachments in an isolated sandbox environment before delivering them, catching malware that static scanning alone would miss.

⚠️ Exam Trap: Safe Links checks a URL's destination at the time of click, not only when the email is first received — this catches attacks where a link is initially benign and turned malicious later.

Reflection Question: Why does checking a link's safety at the moment of click, rather than only at email delivery, catch a category of attacks that delivery-time-only scanning would miss?