ORCA.105: Safe Links Synchronous URL detonation is enabled.
| ID | ORCA.105 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Links |
| Security area | Email and collaboration protection |
| Resource type | Policy |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:SI-3 Malicious Code Protection |
| MITRE ATT&CK | T1566.002 |
| Reads from | Exchange Online |
| Licence needed | ATP_ENTERPRISE |
What this checks and how to fix it
Section titled “What this checks and how to fix it”When the ‘Wait for URL scanning to complete before delivering the message’ option is configured, messages that contain URLs to be scanned will be held until the URLs finish scanning and are confirmed to be safe before the messages are delivered.
Remediation action
Section titled “Remediation action”Enable Safe Links Synchronous URL detonation.
Related Links
Section titled “Related Links”- Microsoft 365 Defender Portal - Safe links
- Recommended settings for EOP and Office 365 Microsoft Defender for Office 365 security
- Set up Microsoft Defender for Office 365 Safe Links policies
Mito check, based on ORCA. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.