Forum Discussion
Block Url Link in Message Body Before Message Delivery
Agree with Dan_Snape - Safe Links is probably the best option although I'm not sure it's going to fit your particular use case; if MS deems the link safe (as in it has good reputation, doesn't have Malware or actually appear dodgy) but you don't want users to go to the URL for other business reasons, then it won't actually block the link. Other solutions approach that if an email contains the specific url the email is either sent to quarantine or otherwise held for review.
Unless I've completely misunderstood your requirements my recommendation is that if you don't want your users to go to a specific URL is to use a web filtering solution to stop users from being able to go to the link that way rather than try to change the email itself.
It's also possible that a 3rd party mail filter solution might be able to do this, but off the top of my head I'm not sure if any of them do.
Agree with Dan_Snape - Safe Links is probably the best option although I'm not sure it's going to fit your particular use case; if MS deems the link safe (as in it has good reputation, doesn't have Malware or actually appear dodgy) but you don't want users to go to the URL for other business reasons, then it won't actually block the link. Other solutions approach that if an email contains the specific url the email is either sent to quarantine or otherwise held for review.
Unless I've completely misunderstood your requirements my recommendation is that if you don't want your users to go to a specific URL is to use a web filtering solution to stop users from being able to go to the link that way rather than try to change the email itself.
It's also possible that a 3rd party mail filter solution might be able to do this, but off the top of my head I'm not sure if any of them do.
Plan to test in Dev Tenant...
Thank You Again.
-Larry
- With the rise of the mov and zip TLDs - did you succeed? I want to quarantine any mail that has a link with the zip/mov ending.
Here is what I did:
New Transportrule (including up to 4 subdomains):
Apply this rule if
Includes these patterns in the message subject or body: '(?i)http(s?):\/\/[A-Za]+\.[A-Za]+\.(mov|zip)' or '(?i)http(s?):\/\/.[A-Za]+\.(mov|zip)' or '(?i)http(s?):\/\/[A-Za]+\.[A-Za]+\.[A-Za]+\.(mov|zip)' or '(?i)http(s?):\/\/[A-Za]+\.[A-Za]+\.[A-Za]+\.[A-Za]+\.(mov|zip)'
Do the following
Deliver the message to the hosted quarantine.
The "real deal" would be
(?i)http(s?):\/\/([A-Z0-9-]+\.)*[A-Z0-9-]+\.(mov|zip)
but Exchange Online doesn't like it:
Failed to update the transport rule
Error:
Invalid Operation: Cannot process argument transformation on parameter 'SubjectOrBodyMatchesPatterns'. Cannot convert value "System.String[]" to type "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.Pattern[]". Error: "You cannot configure a pattern with groups of multiple match conditions like (.*, .+, .{0,n} or .{1,n}). Remove the group or the multiple match condition from the pattern to continue."
