CISA.MS.EXO.15.1: URL comparison with a block-list SHOULD be enabled.

ID	CISA.MS.EXO.15.1
Severity	Medium
Suite	CISA SCuBA baselines
Product	Exchange Online
Related products	Defender
Feature	Safe Links
Security area	Email and collaboration protection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.15.1 (SHOULD)
Framework controls	cisa-scuba:MS.EXO.15.1 nist-800-53-r5:SI-3 Malicious Code Protection
MITRE ATT&CK	T1566.002, T1204.001
Reads from	Exchange Online, Microsoft Graph, Security & Compliance PowerShell
Licence needed	ATP_ENTERPRISE

What this checks and how to fix it

URL comparison with a block-list SHOULD be enabled.

Rationale: Users may be directed to malicious websites via links in email. Blocking access to known, malicious URLs can prevent users from accessing known malicious websites.

Remediation action:

1. Sign in to Microsoft 365 Defender.
2. In the left-hand menu, go to Email & Collaboration > Policies & Rules.
3. Select Threat Policies.
4. From the Templated policies section, select Preset Security Policies.
5. Under either Standard protection or Strict protection, select Manage protection settings.
6. Select Next until you reach the Apply Defender for Office 365 protection page.
7. On the Apply Defender for Office 365 protection page, select All recipients.
8. (Optional) Under Exclude these recipients, add Users and Groups to be exempted from the preset policies.
9. Select Next on each page until the Review and confirm your changes page.
10. On the Review and confirm your changes page, select Confirm.

Related links

• Defender admin center - Preset security policies
• CISA 15 Link Protection - MS.EXO.15.1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: thomas-s-schmidt. Open-source licences.