# Distinguish blocked campaign clicks from Safe Links overrides

> How should an analyst interpret different URL-click outcomes in a Defender email campaign?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:31+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How should an analyst interpret different URL-click outcomes in a Defender email campaign?

## Potentially affected

Use this review when investigating the URL-click portion of a Microsoft Defender for Office 365 campaign. Keep the campaign, message and recipient evidence linked when deciding which follow-up work is warranted.

## DSE recommendation

DSE recommends separating attempted clicks, blocked navigation and permitted overrides in the campaign summary.

## Article

## Source facts

A campaign click marked BlockPage means the recipient selected the payload URL but Safe Links blocked access to the malicious site. BlockPageOverride means the recipient was allowed to continue past the Safe Links block; PendingDetonationPageOverride means the recipient continued before detonation finished. Microsoft recommends investigating why the phishing message reached the mailbox even when its URL was not selected. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/campaigns).

## Applicability

Use this review when investigating the URL-click portion of a Microsoft Defender for Office 365 campaign. Keep the campaign, message and recipient evidence linked when deciding which follow-up work is warranted.

## DSE recommendation

DSE recommends separating attempted clicks, blocked navigation and permitted overrides in the campaign summary. Give each outcome an explicit investigation decision, and review the responsible Safe Links policy when an override appears. Keep the message-delivery investigation open alongside the click analysis until its cause is understood.

## Verification

Trace a representative event of each observed outcome to its message and relevant policy. Confirm that the written case summary uses the documented result instead of treating all clicks as equivalent. Retain the supporting timestamps and identifiers, and state any unresolved evidence before concluding the campaign review.

## Official references

[Microsoft Learn: Campaigns in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/campaigns). Source reviewed September 17, 2026.

## Primary reference

- Name: Campaigns in Microsoft Defender for Office 365 Plan - Microsoft Defender for Office 365 | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-office-365/campaigns
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Distinguish blocked campaign clicks from Safe Links overrides,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-089-distinguish-blocked-campaign-clicks-from-safe-links-overrides/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.