> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outkept.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Safe Links

> Stop Safe Links rewriting the URLs in our simulations.

Safe Links rewrites the URLs in incoming mail. Rewritten links break interaction tracking, so
simulations need a bypass.

<Info>
  Do [Domain & IP whitelisting](/whitelisting-ms-domains-ips) first. This is an addition to it,
  not a replacement.
</Info>

The setup differs between Microsoft Defender plan 1 and plan 2. Follow the one that matches
your subscription.

<Warning>
  Do not apply both rules. They interfere with each other.
</Warning>

<Tabs>
  <Tab title="Defender plan 1">
    Plan 1 has no Safe Links policy page, so the bypass is done with a mail flow rule that
    stamps a header on our mail.

    <Steps>
      <Step title="Open the Exchange admin center">
        Go to [admin.exchange.microsoft.com](https://admin.exchange.microsoft.com/).
      </Step>

      <Step title="Create a rule">
        Go to **Mail flow** then **Rules**, click **Add a rule** and **Create a new rule**.
        Name it something like `Bypass Safe Links - OutKept IP Address`.
      </Step>

      <Step title="Set the condition">
        Under **Apply this rule if**, select *The Sender* then *IP address is in any of these
        ranges or exactly matches*, and enter our
        [sending IP addresses](/whitelisting-values#sending-ip-addresses).
      </Step>

      <Step title="Set the action">
        Under **Do the following**, select *Modify the message properties* then *set a message
        header*. Using the **Enter text** buttons, set the header to
        `X-MS-Exchange-Organization-SkipSafeLinksProcessing` and the value to `1`.
      </Step>

      <Step title="Finish">
        Leave everything in **Set rule settings** at its default, then review and click
        **Finish**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Defender plan 2">
    Plan 2 has a Safe Links policy where our domains can be excluded from rewriting directly.

    <Steps>
      <Step title="Open Defender">
        From the Microsoft 365 admin center, click **Security**, then **Policies & rules** then
        **Threat policies**, then **Safe Links**.

        No Safe Links entry there? You are most likely on plan 1. Use the other tab.
      </Step>

      <Step title="Create the policy">
        Click **Create**, name it `OutKept Safe Link Bypass` and click **Next**.
      </Step>

      <Step title="Scope it to everyone">
        Make sure the policy covers all employees. Select a group if you have one that applies,
        or enter the domain or domains all employees fall under.
      </Step>

      <Step title="Add the URLs">
        Leave the rest at their defaults, select the **Manage 0 Urls** link, then **Add URLs**.
        Under **Do not rewrite the following URLs**, add every domain in the
        [wildcard form](#wildcard-form) described below.
      </Step>

      <Step title="Submit">
        Click **Next** and **Submit**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Wildcard form

Safe Links matches on URL patterns rather than bare domains, so the plan 2 policy will not
accept a bare domain name. Take each entry from the
[full domain list](/whitelisting-values#domains) and add it twice, once with a
leading wildcard and once without:

```
*.communicationmail.com/*
communicationmail.com/*
```

<Warning>
  Adding only the `*.domain/*` variant misses links on the domain itself, which is where most
  of our simulation links point. Both variants are needed.
</Warning>

<Note>
  Changes can take up to an hour to take effect. Test after that, not before.
</Note>

## Then what

**Have other security products enabled? Whitelist them now.**

| Product | Where to go |
| - | - |
| Other Microsoft products: Safe Links, Safe Attachments, web protection, whitelisting by header | [Microsoft 365](/whitelisting-microsoft-365) |
| Third-party gateways and firewalls: Barracuda, FortiNet, Vade, WatchGuard | [Whitelisting](/whitelisting) |

Once everything that applies to your environment is whitelisted, send a test email from the
platform and confirm every interaction is recorded. See
[Testing your whitelisting](/whitelisting-testing).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.