Safelisting in Microsoft Safe Links

This article describes how to create URL allow entries that are available in the Tenant Allow/Block List. This is done by submitting the URL as a false positive, which will then add an allow entry on the URLs tab in the Tenant Allow/Block List. You will want to submit URLs if your targets receive the following warning when clicking links in simulated phishing emails. 

Follow the steps below to submit URLs to the Allow list.

1. In the Microsoft 365 Defender portal at https://security.microsoft.com, go to the Submissions page at Actions & submissions > Submissions. To go directly to the Submissions page, use https://security.microsoft.com/reportsubmission.

2. On the Submissions page, select the URLs tab

3. On the URLs tab, click  Submit to Microsoft for analysis.

4. In the Submit to Microsoft for analysis flyout that appears, enter the following information:

   • Select the submission type: Verify the value URL is selected.

   • URL: Enter the domain with a trailing "/*"  (for example,  fabrikam.com/*), and then select it in the box that appears. You can enter up to 50 URLs at once.

   • Select a reason for submitting to Microsoft: Select Should not have been blocked (False positive), and then configure the following settings:

     • Allow this URL: Turn on this setting .

       • Remove allow entry after: The default value is 30 days, but you can select from the following values:

         • 1 day
         • 7 days
         • 30 days
         • Specific date: The maximum value is 30 days from today.

       • Allow entry note: Enter optional information about why you're allowing and submitting this URL.

   When you're finished, click Submit, and then click Done.

   

After a few moments, the allow entry will appear on the URL tab on the Tenant Allow/Block List page. For more information about the Tenant Allow/Block List, see Manage allows and blocks in the Tenant Allow/Block List.