Note that there have been changes to Safe Links policy for Microsoft Defender for Office 365 (MDO).
Previously you could add URLs to the Safe Links policy to control how MDO would process the URLs. As part of this change the URL blocking is moving to the Tenant Allow Block List (TABL).
Below is a screenshot showing that a previously entered URL needs to be migrated to TABL.
Microsoft 365 Message Centre Post - MC 373880
MC373880 Migrating the Safe Links Block List to Tenant Allow Block List
Updated October 06, 2022: As a reminder Tenants will have until January 2023 to review and take action on any entries in the Safe Links Block List that were unable to be migrated. Any entries that are unable to be migrated will be marked as such and organizations will have the ability to resolve that entry and run the migration again. In January 2023 the Safe Links Global Block List will be retired.
We have stopped the automated migration efforts to migrate all entries from your Safe Links Block List to the Tenant Allow Block List. Organizations will have the ability to review and take action on the entries that were unable to be migrated. Any entries that are unable to be migrated will be marked as such and organizations will have the ability to resolve that entry and run the migration again. Tenants will have until January 2023 to complete this activity, at which point the Safe Links Global Block List will be retired.
Note: Any entry migrated from the Safe Links Block List to the Tenant Allow/Block List will adopt the behavior of TABL. This means that any message with the URL present will be moved to Quarantine. If deleting an already migrated entry from TABL, it needs to be removed from BlockURLS to avoid migration.
As a reminder beginning in June tenants will no longer have the ability to add to the Safe Links Block List in the Global Setting menu. Then we will attempt to migrate the Safe Links Block List to the Tenant Allow Block List (TABL) on behalf of the organization. Any entries that are unable to be successfully migrated, they will be marked as such in the Block List and organizations will have the ability to take action as needed beginning in July.
Another update will be sent closer to July as a reminder for tenants to review the migration status of the Block List. Beginning in June organizations will no longer have the ability to add to the Safe Links Block List in the Global Setting menu. Following this, we will attempt to migrate the Safe Links Block List to the Tenant Allow Block List (TABL) on behalf of the organization. For any entries that we are unable to migrate, they will be marked as such in the Block List and organizations will have the ability to take action as needed.
When this will happen:
- Early June: Organizations will no longer have the ability to add to the URL/Domain entries to the Safe Links Block List in the Global Settings flyout and we will attempt to migrate all the entries in an organization's Safe Links Block List to TABL on their behalf
- Mid-June through December: Organizations will have the ability review entries that were not able to be migrated and resolve the issue(s)
- January: The Safe Links Block List will be retired
How this will affect your organization:
Organizations who are utilizing the Safe Links Block List will need to review the list to ensure all entries were migrated successfully. Any entries that are unable to be migrated will be marked as such and organizations will have the ability to resolve that entry, at which point migration will run again.
Organizations will use the Tenant Allow Block List to manage URL/Domain blocks moving forward.
What you need to do to prepare:
In June an update to this Message center post will be sent notifying organizations that the first migration has been completed and they will need to review their Safe Links Block Lists for potential actions.
Cheers,
Rhoderick
