Auditing Safe Links Policies in Exchange Online with PowerShell

Protecting your organization from phishing attacks and malicious links is crucial, and Exchange Online’s Safe Links feature plays a key role in this defense. However, it’s important to ensure that Safe Links policies are correctly configured and applied across all necessary domains.

This article provides a step-by-step guide on how to use PowerShell to audit Safe Links policies in Exchange Online. The script checks if these policies are applied to all domains, helping administrators maintain consistent protection across their entire organization.

Here is the script:

Connect to Exchange Online

Connect-ExchangeOnline

Get all Safe Links policies

$safeLinksPolicies = Get-SafeLinksPolicy

Function to check if Safe Links policies are applied to all domains

function Check-SafeLinksPolicy { param ( [string]$policyName )

Get the details of the specific Safe Links policy

$policy = Get-SafeLinksPolicy -Identity $policyName

Check if the policy is applied to all domains

$appliedToAllDomains = $true

if ($policy.DomainsIncluded.Count -eq 0 -and $policy.DomainsExcluded.Count -eq 0) { $appliedToAllDomains = $true } else { $appliedToAllDomains = $false }

return $appliedToAllDomains }

Prepare an array to hold the policy check results

$policyCheckResults = @()

foreach ($policy in $safeLinksPolicies) { $policyName = $policy.Name $isAppliedToAllDomains = Check-SafeLinksPolicy -policyName $policyName

$policyCheckResults += [PSCustomObject]@{ PolicyName = $policyName AppliedToAllDomains = $isAppliedToAllDomains } }

Display the policy check results

$policyCheckResults | Format-Table -AutoSize

Optionally export to CSV

$policyCheckResults | Export-Csv -Path “SafeLinksPolicyCheckResults.csv” -NoTypeInformation Write-Output “Safe Links policy check results exported to SafeLinksPolicyCheckResults.csv”

Disconnect from Exchange Online

Disconnect-ExchangeOnline -Confirm:$false