Microsoft Defender for Office 365: Updates to URL Protection Report

Microsoft Exchange Online, Microsoft 365 Experts

From Microsoft Corporation
Technical Bulletin MC318994 · Published Jan 27, 2022

We are enhancing the URL protection report by including new click actions to the reporting.

This message is associated with Microsoft 365 Roadmap ID 88880.

When will this happen:

We will begin rolling this out to standard release customers by the end of March and we expect to be complete by early April.
We will begin rolling this out to government customers in mid-April and we expect to be complete by the end of April

How this will affect your organization:

1. URL protection report Action view:

Previous we only had four kinds of User click action that existed in the URL protection report which were namely:
- “Allowed” – Clicks allowed by system
- “Blocked” – Clicks blocked by system
- “Blocked and clicked through” – Blocked clicks where a user clicks through to the blocked URL.
- “Clicked through during scan” – Clicks that where the user clicks through the pending scan page to the URL.

We will be introducing four new actions that will help Admins have better insights to the new actions that exist within their organization tenant. These new actions are:
- “Admin allowed” – Clicks allowed by the admin as part of the safe links policy
- “Admin block” – Clicks that are blocked by the admin as part of the safe links policy
- “Pending scan” – Clicks on URLs that are pending a scan verdict
- “Admin blocked and click through” – Admin has blocked the link but the user clicked through

2. URL protection report application view

Previously in the application view of the URL protection we had the following categories:
- Email client
- PowerPoint
- Word
- Excel
- OneNote
- Visio
- Teams and Others.
With these new updates, we will be merging the PowerPoint, Word, Excel, OneNote, and Visio categories into one consolidated view and call it “Office”