Microsoft 365: Defender - Safe Links Enabled - User Percent

Metric Name: Microsoft 365: Defender - Safe Links Enabled - User Percent

Category: Security

Description: This metric monitors the percentage of users who have the Safe Links feature enabled in Microsoft 365 Defender. Safe Links helps protect users from malicious URLs in emails, documents, and other Office 365 services by scanning links and preventing access to harmful content.

Purpose: The purpose of this metric is to ensure that Safe Links, a critical feature for preventing phishing and other malware attacks, is enabled for a high percentage of users across the organization. This helps ensure the organization is fully leveraging Microsoft 365’s advanced security features to safeguard against potential threats.

How it works:

• The metric uses a query (SecureScores.controlScores[?controlName=='mdo_safelinksforOfficeApps'].scoreInPercentage) to pull data from Microsoft 365’s Secure Score, specifically the control related to Safe Links in Office applications.

• The result is a percentage value indicating how many users have Safe Links enabled, providing insight into the organization’s protection level.

Beneficiaries:

• Security Teams: Can verify that Safe Links is widely enabled, ensuring the organization is protected against malicious URLs.

• IT Administrators: Gain visibility into the security setup of Microsoft 365 environments, helping them enforce security best practices.

• End Users: Benefit from enhanced security measures, reducing the risk of phishing attacks and exposure to malicious websites.

Additional Notes:

• Customization: This query can be modified to track the Safe Links feature across other Office 365 apps or services by adjusting the controlName. For example, if you want to monitor the feature in another application, updating the query to reflect the specific app name will provide more granular insights.

• Why this is valuable: Ensuring a high percentage of users have Safe Links enabled minimizes the risk of successful phishing or malware attacks, improving the overall security posture of the organization.