Scan Messages for Unsafe Links [CHK-1625]

Rationale

Microsoft Teams is a common platform for communication within organizations. Attackers can exploit this by sending malicious links via Teams messages. Users often trust these messages more than emails, making them susceptible to clicking on unverified links. The Safe Links feature in Teams uses Microsoft Defender for Office 365 to check URLs in real-time when users click on them. If a link is identified as malicious, a warning is displayed to the user before the website opens, preventing access to phishing sites, malware, or other dangerous websites. Without this protection, users are vulnerable to attacks such as credential phishing, malware downloads, or business email compromise (BEC) attacks.

Fix

An automated fix is available through Attic.

Manual steps:

1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com
2. Go to Messaging
3. Go to Chat settings.
4. Scroll to Message safety.
5. Turn on "Malicious URL protection".
6. Save the changes.

Impact

Enabling this feature will ensure that all URLs within Teams messages are checked for a malicious reputation, protecting users from potential cyber threats.

More Information

• Microsoft Teams security guide - Safe Links
• Set-CsTeamsMessagingConfiguration PowerShell documentation