Forum Discussion
Solved
Office 365 SafeLinks ATP custom URL
Hello!
I'm looking to build a dynamic script that pulls known-phishing sites from various sources and add these dynamically to SafeLinks policy. I did a bit of research and unfortunately I have found no option to add custom blacklisted URLs onto Office 365 - I can manage the policy settings in general, but I can't find an option that would allow me to automate my own custom URLs and domains. Both Graph API (seemingly unable to manage ATP Safelinks at all) and Powershell (some Safelink management) do not seem to expose this option.
Any help?
Alex P
- How about this command?
Set-AtpPolicyForO365 -BlockUrls <MultiValuedProperty>
https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/set-atppolicyforo365?view=exchange-ps
Keep in mind when you run the command above, it will overwrite any previous values that were in the blocklist, so you need to use the @Add to append.
set-AtpPolicyForO365 -BlockUrls @{add='contoso.com'}
If you wish to automate, you could use Azure Automation Runbook to read phishing sites from various sources, and then run Set-AtpPolicyForO365 to update the block policy.
https://docs.microsoft.com/en-us/azure/automation/learn/automation-tutorial-runbook-textual-powershell
If this was helpful please click 'Mark as best response.'
-Joe
1 Reply
- How about this command?
Set-AtpPolicyForO365 -BlockUrls <MultiValuedProperty>
https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/set-atppolicyforo365?view=exchange-ps
Keep in mind when you run the command above, it will overwrite any previous values that were in the blocklist, so you need to use the @Add to append.
set-AtpPolicyForO365 -BlockUrls @{add='contoso.com'}
If you wish to automate, you could use Azure Automation Runbook to read phishing sites from various sources, and then run Set-AtpPolicyForO365 to update the block policy.
https://docs.microsoft.com/en-us/azure/automation/learn/automation-tutorial-runbook-textual-powershell
If this was helpful please click 'Mark as best response.'
-Joe