Microsoft Defender for Office 365: Updates to URL Protection Report

Originally posted by Microsoft Jan 28, 2022 Exchange Online 0 Comments

We are enhancing the URL protection report by including new click actions to the reporting.

This message is associated with Microsoft 365 Roadmap ID 88880.

When will this happen:

We will begin rolling this out to standard release customers by the end of March and we expect to be complete by early April.
We will begin rolling this out to government customers in mid-April and we expect to be complete by the end of April

How this will affect your organization:

1. URL protection report Action view:

Previous we only had four kinds of User click action that existed in the URL protection report which were namely:
- “Allowed” – Clicks allowed by system
- “Blocked” – Clicks blocked by system
- “Blocked and clicked through” – Blocked clicks where a user clicks through to the blocked URL.
- “Clicked through during scan” – Clicks that where the user clicks through the pending scan page to the URL.

2. URL protection report application view

What you need to do to prepare:

We will be introducing four new actions that will help Admins have better insights to the new actions that exist within their organization tenant. These new actions are:
- “Admin allowed” – Clicks allowed by the admin as part of the safe links policy
- “Admin block” – Clicks that are blocked by the admin as part of the safe links policy
- “Pending scan” – Clicks on URLs that are pending a scan verdict
- “Admin blocked and click through” – Admin has blocked the link but the user clicked through

Previously in the application view of the URL protection we had the following categories:
- Email client
- PowerPoint
- Word
- Excel
- OneNote
- Visio
- Teams and Others.
With these new updates, we will be merging the PowerPoint, Word, Excel, OneNote, and Visio categories into one consolidated view and call it “Office”

To prepare for these changes please updates your reporting documents and Cmdlets (Get-SafeLinksAggregateReport and Get-SafeLinksDetailReport ).

Message ID: MC318994