Auditing Safe Links Policies in Exchange Online with PowerShell

Protecting your organization from phishing attacks and malicious links is crucial, and Exchange Online's Safe Links feature plays a key role in this defense. However, it's important to ensure that Safe Links policies are correctly configured and applied across all necessary domains.

This article provides a step-by-step guide on how to use PowerShell to audit Safe Links policies in Exchange Online. The script checks if these policies are applied to all domains, helping administrators maintain consistent protection across their entire organization.

Here is the script:

# Connect to Exchange Online

Connect-ExchangeOnline

# Get all Safe Links policies

$safeLinksPolicies = Get-SafeLinksPolicy

# Function to check if Safe Links policies are applied to all domains

function Check-SafeLinksPolicy {

param (

[string]$policyName

)

# Get the details of the specific Safe Links policy

$policy = Get-SafeLinksPolicy -Identity $policyName

# Check if the policy is applied to all domains

$appliedToAllDomains = $true

if ($policy.DomainsIncluded.Count -eq 0 -and $policy.DomainsExcluded.Count -eq 0) {

$appliedToAllDomains = $true

} else {

$appliedToAllDomains = $false

}

return $appliedToAllDomains

}

# Prepare an array to hold the policy check results

$policyCheckResults = @()

foreach ($policy in $safeLinksPolicies) {

$policyName = $policy.Name

$isAppliedToAllDomains = Check-SafeLinksPolicy -policyName $policyName

$policyCheckResults += [PSCustomObject]@{

PolicyName = $policyName

AppliedToAllDomains = $isAppliedToAllDomains

}

# Display the policy check results

$policyCheckResults | Format-Table -AutoSize

# Optionally export to CSV

$policyCheckResults | Export-Csv -Path "SafeLinksPolicyCheckResults.csv" -NoTypeInformation

Write-Output "Safe Links policy check results exported to SafeLinksPolicyCheckResults.csv"

# Disconnect from Exchange Online

Disconnect-ExchangeOnline -Confirm:$false