Distinguish blocked campaign clicks from Safe Links overrides

Source facts

A campaign click marked BlockPage means the recipient selected the payload URL but Safe Links blocked access to the malicious site. BlockPageOverride means the recipient was allowed to continue past the Safe Links block; PendingDetonationPageOverride means the recipient continued before detonation finished. Microsoft recommends investigating why the phishing message reached the mailbox even when its URL was not selected. Microsoft Learn.

Applicability

Use this review when investigating the URL-click portion of a Microsoft Defender for Office 365 campaign. Keep the campaign, message and recipient evidence linked when deciding which follow-up work is warranted.

DSE recommendation

DSE recommends separating attempted clicks, blocked navigation and permitted overrides in the campaign summary. Give each outcome an explicit investigation decision, and review the responsible Safe Links policy when an override appears. Keep the message-delivery investigation open alongside the click analysis until its cause is understood.

Verification

Trace a representative event of each observed outcome to its message and relevant policy. Confirm that the written case summary uses the documented result instead of treating all clicks as equivalent. Retain the supporting timestamps and identifiers, and state any unresolved evidence before concluding the campaign review.

Official references

Microsoft Learn: Campaigns in Microsoft Defender for Office 365. Source reviewed September 17, 2026.