M365 Changelog: (Updated) Microsoft Defender for Office 365: Updates to URL Protection Report

MC318994 – Updated May 24, 2022: Microsoft has updated the rollout timeline below. Thank you for your patience.

Microsoft is enhancing the URL protection report by including new click actions to the reporting.

This message is associated with Microsoft 365 Roadmap ID 88880.

When will this happen:

• Microsoft will begin rolling this out to standard release customers by the end of March and it expects to be complete by late April (previously early April).
• Microsoft will begin rolling this out to government customers in early May (previously mid-April) and it expects to be complete by late May (previously mid-May).

How this will affect your organization:

1. URL protection report Action view:

• Previous Microsoft only had four kinds of User click action that existed in the URL protection report which were namely:
  • “Allowed” – Clicks allowed by system
  • “Blocked” – Clicks blocked by system
  • “Blocked and clicked through” – Blocked clicks where a user clicks through to the blocked URL.
  • “Clicked through during scan” – Clicks that where the user clicks through the pending scan page to the URL.

• Microsoft will be introducing four new actions that will help Admins have better insights to the new actions that exist within their organization tenant. These new actions are:
  • “Admin allowed” – Clicks allowed by the admin as part of the safe links policy
  • “Admin block” – Clicks that are blocked by the admin as part of the safe links policy
  • “Pending scan” – Clicks on URLs that are pending a scan verdict
  • “Admin blocked and click through” – Admin has blocked the link but the user clicked through

2. URL protection report application view

• Previously in the application view of the URL protection Microsoft had the following categories:
  • Email client
  • PowerPoint
  • Word
  • Excel
  • OneNote
  • Visio
  • Teams and Others.
• With these new updates, Microsoft will be merging the PowerPoint, Word, Excel, OneNote, and Visio categories into one consolidated view and call it “Office”

What you need to do to prepare:

To prepare for these changes please updates your reporting documents and Cmdlets (Get-SafeLinksAggregateReport and Get-SafeLinksDetailReport ).