{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/", "slug": "dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides", "url": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/" }, "title": "Distinguish blocked campaign clicks from Safe Links overrides", "summary": "How should an analyst interpret different URL-click outcomes in a Defender email campaign?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:31+00:00", "modified_at": "2026-09-17T16:38:46+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 203, "potentially_affected": "Use this review when investigating the URL-click portion of a Microsoft Defender for Office 365 campaign. Keep the campaign, message and recipient evidence linked when deciding which follow-up work is warranted.", "dse_recommendation": "DSE recommends separating attempted clicks, blocked navigation and permitted overrides in the campaign summary.", "primary_source": { "name": "Campaigns in Microsoft Defender for Office 365 Plan - Microsoft Defender for Office 365 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-office-365/campaigns", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A campaign click marked BlockPage means the recipient selected the payload URL but Safe Links blocked access to the malicious site. BlockPageOverride means the recipient was allowed to continue past the Safe Links block; PendingDetonationPageOverride means the recipient continued before detonation finished. Microsoft recommends investigating why the phishing message reached the mailbox even when its URL was not selected. Microsoft Learn.

\n

Applicability

\n

Use this review when investigating the URL-click portion of a Microsoft Defender for Office 365 campaign. Keep the campaign, message and recipient evidence linked when deciding which follow-up work is warranted.

\n

DSE recommendation

\n

DSE recommends separating attempted clicks, blocked navigation and permitted overrides in the campaign summary. Give each outcome an explicit investigation decision, and review the responsible Safe Links policy when an override appears. Keep the message-delivery investigation open alongside the click analysis until its cause is understood.

\n

Verification

\n

Trace a representative event of each observed outcome to its message and relevant policy. Confirm that the written case summary uses the documented result instead of treating all clicks as equivalent. Retain the supporting timestamps and identifiers, and state any unresolved evidence before concluding the campaign review.

\n

Official references

\n

Microsoft Learn: Campaigns in Microsoft Defender for Office 365. Source reviewed September 17, 2026.

", "content_text": "Source facts\nA campaign click marked BlockPage means the recipient selected the payload URL but Safe Links blocked access to the malicious site. BlockPageOverride means the recipient was allowed to continue past the Safe Links block; PendingDetonationPageOverride means the recipient continued before detonation finished. Microsoft recommends investigating why the phishing message reached the mailbox even when its URL was not selected. Microsoft Learn.\nApplicability\nUse this review when investigating the URL-click portion of a Microsoft Defender for Office 365 campaign. Keep the campaign, message and recipient evidence linked when deciding which follow-up work is warranted.\nDSE recommendation\nDSE recommends separating attempted clicks, blocked navigation and permitted overrides in the campaign summary. Give each outcome an explicit investigation decision, and review the responsible Safe Links policy when an override appears. Keep the message-delivery investigation open alongside the click analysis until its cause is understood.\nVerification\nTrace a representative event of each observed outcome to its message and relevant policy. Confirm that the written case summary uses the documented result instead of treating all clicks as equivalent. Retain the supporting timestamps and identifiers, and state any unresolved evidence before concluding the campaign review.\nOfficial references\nMicrosoft Learn: Campaigns in Microsoft Defender for Office 365. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nA campaign click marked BlockPage means the recipient selected the payload URL but Safe Links blocked access to the malicious site. BlockPageOverride means the recipient was allowed to continue past the Safe Links block; PendingDetonationPageOverride means the recipient continued before detonation finished. Microsoft recommends investigating why the phishing message reached the mailbox even when its URL was not selected. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/campaigns).\n\n## Applicability\n\nUse this review when investigating the URL-click portion of a Microsoft Defender for Office 365 campaign. Keep the campaign, message and recipient evidence linked when deciding which follow-up work is warranted.\n\n## DSE recommendation\n\nDSE recommends separating attempted clicks, blocked navigation and permitted overrides in the campaign summary. Give each outcome an explicit investigation decision, and review the responsible Safe Links policy when an override appears. Keep the message-delivery investigation open alongside the click analysis until its cause is understood.\n\n## Verification\n\nTrace a representative event of each observed outcome to its message and relevant policy. Confirm that the written case summary uses the documented result instead of treating all clicks as equivalent. Retain the supporting timestamps and identifiers, and state any unresolved evidence before concluding the campaign review.\n\n## Official references\n\n[Microsoft Learn: Campaigns in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/campaigns). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/", "url": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Distinguish blocked campaign clicks from Safe Links overrides", "item": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/", "url": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/", "headline": "Distinguish blocked campaign clicks from Safe Links overrides", "description": "How should an analyst interpret different URL-click outcomes in a Defender email campaign?", "abstract": "How should an analyst interpret different URL-click outcomes in a Defender email campaign?", "articleBody": "Source facts\nA campaign click marked BlockPage means the recipient selected the payload URL but Safe Links blocked access to the malicious site. BlockPageOverride means the recipient was allowed to continue past the Safe Links block; PendingDetonationPageOverride means the recipient continued before detonation finished. Microsoft recommends investigating why the phishing message reached the mailbox even when its URL was not selected. Microsoft Learn.\nApplicability\nUse this review when investigating the URL-click portion of a Microsoft Defender for Office 365 campaign. Keep the campaign, message and recipient evidence linked when deciding which follow-up work is warranted.\nDSE recommendation\nDSE recommends separating attempted clicks, blocked navigation and permitted overrides in the campaign summary. Give each outcome an explicit investigation decision, and review the responsible Safe Links policy when an override appears. Keep the message-delivery investigation open alongside the click analysis until its cause is understood.\nVerification\nTrace a representative event of each observed outcome to its message and relevant policy. Confirm that the written case summary uses the documented result instead of treating all clicks as equivalent. Retain the supporting timestamps and identifiers, and state any unresolved evidence before concluding the campaign review.\nOfficial references\nMicrosoft Learn: Campaigns in Microsoft Defender for Office 365. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:31+00:00", "dateModified": "2026-09-17T16:38:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish blocked campaign clicks from Safe Links overrides" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 203, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Campaigns in Microsoft Defender for Office 365 Plan - Microsoft Defender for Office 365 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-office-365/campaigns" } } ] } }