Skip to main content
Safe Links rewrites the URLs in incoming mail. Rewritten links break interaction tracking, so simulations need a bypass.
Do Domain & IP whitelisting first. This is an addition to it, not a replacement.
The setup differs between Microsoft Defender plan 1 and plan 2. Follow the one that matches your subscription.
Do not apply both rules. They interfere with each other.
Plan 1 has no Safe Links policy page, so the bypass is done with a mail flow rule that stamps a header on our mail.
1

Open the Exchange admin center

Go to admin.exchange.microsoft.com.
2

Create a rule

Go to Mail flow then Rules, click Add a rule and Create a new rule. Name it something like Bypass Safe Links - OutKept IP Address.
3

Set the condition

Under Apply this rule if, select The Sender then IP address is in any of these ranges or exactly matches, and enter our sending IP addresses.
4

Set the action

Under Do the following, select Modify the message properties then set a message header. Using the Enter text buttons, set the header to X-MS-Exchange-Organization-SkipSafeLinksProcessing and the value to 1.
5

Finish

Leave everything in Set rule settings at its default, then review and click Finish.

​
Wildcard form

Safe Links matches on URL patterns rather than bare domains, so the plan 2 policy will not accept a bare domain name. Take each entry from the full domain list and add it twice, once with a leading wildcard and once without:
Adding only the *.domain/* variant misses links on the domain itself, which is where most of our simulation links point. Both variants are needed.
Changes can take up to an hour to take effect. Test after that, not before.

​
Then what

Have other security products enabled? Whitelist them now. Once everything that applies to your environment is whitelisted, send a test email from the platform and confirm every interaction is recorded. See Testing your whitelisting.