Describe the capabilities of Microsoft security solutions →mediumMultiple Select

Microsoft Defender for Office 365 Capabilities: Safe Links, Safe Attachments, and Anti-Phishing

Which THREE of the following are capabilities of Microsoft Defender for Office 365?

Quick Answer

The answer is Safe Links, Safe Attachments, and Anti-Phishing. These three capabilities form the core of Microsoft Defender for Office 365, each targeting a distinct attack vector: Safe Links proactively rewrites and scans URLs in emails and Office documents at the moment of click, routing traffic through Microsoft’s protection infrastructure to block malicious or phishing sites in real time; Safe Attachments uses detonation chambers to open and analyze email attachments in a sandboxed environment before delivery; and Anti-Phishing applies machine learning and impersonation detection to guard against deceptive messages targeting user credentials. On the SC-900 exam, this question tests your understanding of how Defender for Office 365 layers defenses across email and collaboration tools—a common trap is confusing Safe Links with Safe Attachments, so remember that links are for URLs and attachments are for files. A helpful mnemonic is “L.A.P.”: Links, Attachments, Phishing.

⚠ Common exam trap

Watch out — candidates often confuse the scope of Microsoft Defender for Office 365 with other Microsoft 365 security products, mistakenly attributing cloud discovery (Defender for Cloud Apps) or device compliance (Intune) to Defender for Office 365, which is strictly focused on email and Office document protection.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Safe Links protection in email and Office documents

Safe Links (A) is a core Defender for Office 365 capability that rewrites and time-of-click verifies URLs in email messages and Office documents to block malicious redirects. Anti-phishing policies (B) are also native to Defender for Office 365, providing impersonation protection for users, domains, and mailbox intelligence to defend against phishing and spoofing. Safe Attachments (E) is likewise a Defender for Office 365 feature that detonates attachments in a sandbox to detect zero-day malware before delivery. Cloud discovery of unsanctioned SaaS apps (C) belongs to Microsoft Defender for Cloud Apps (formerly MCAS), not Defender for Office 365. Device compliance policies for mobile devices (D) are handled by Microsoft Intune and conditional access, not by Defender for Office 365.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Safe Links protection in email and Office documents
Why this is correct
Safe Links rewrites URLs in inbound email and Office documents, then checks each click against Microsoft's blocklist at time of access, catching weaponised links delivered after scanning. This satisfies the stem's requirement for a Defender for Office 365 capability, specifically real-time URL detonation and blocking within the Safe Attachments and Safe Links policy family.
✓
Anti-phishing policies to protect against impersonation
Why this is correct
Anti-phishing policies in Microsoft Defender for Office 365 detect impersonation through mailbox intelligence, spoof intelligence and user/domain impersonation protection, quarantining or junking deceptive messages. This directly satisfies the stem's requirement for a Defender for Office 365 capability, unlike licensing or identity features.
✗
Cloud discovery of unsanctioned SaaS apps
Why it's wrong here
Cloud discovery of unsanctioned SaaS apps is a Microsoft Defender for Cloud Apps capability, not Defender for Office 365. Defender for Office 365 protects email and collaboration workloads via Safe Links, Safe Attachments and anti-phishing; cloud app discovery fits CASB-focused questions instead.
✗
Device compliance policies for mobile devices
Why it's wrong here
Device compliance policies belong to Microsoft Intune and Microsoft Entra ID conditional access, governing endpoint health rather than email threat protection. Defender for Office 365 covers Safe Attachments, Safe Links and anti-phishing; compliance policies are the right answer for endpoint management scenarios.
✓
Safe Attachments scanning in email
Why this is correct
Safe Attachments detonates email attachments in a sandbox before delivery, catching zero-day malware that signature-based filtering misses. This directly satisfies the stem's requirement for a Defender for Office 365 capability, as the service provides this protection against advanced threats arriving through Exchange Online mail flow.

Go deeper

2 more ways this is tested on SC-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Which TWO of the following are capabilities of Microsoft Defender for Office 365?

hard

✓ A.Scan email attachments in a sandbox environment before delivery
✓ B.Protect against spear-phishing attacks using impersonation protection
C.Enforce device compliance policies for mobile devices
D.Place a legal hold on mailboxes for eDiscovery
E.Monitor user behavior for compromised accounts

Why A: Option A is correct because Microsoft Defender for Office 365 includes Safe Attachments, which detonates email attachments in a sandbox (virtual environment) to detect malicious behavior before delivering the message. Option B is correct because Defender for Office 365 provides anti-phishing policies with impersonation protection that detect spoofed or impersonated senders (e.g., executives, domains) to defend against spear-phishing. Option C is incorrect because device compliance policies for mobile devices are enforced by Microsoft Intune (part of Microsoft Endpoint Manager), not Defender for Office 365. Option D is incorrect because legal hold for eDiscovery is a Microsoft Purview (Exchange/Compliance) capability, not a Defender for Office 365 feature. Option E is incorrect because monitoring user behavior for compromised accounts is handled by Microsoft Defender for Identity (or Entra ID Protection), not Defender for Office 365.

Variation 2. Which TWO are capabilities of Microsoft Defender for Office 365?

medium

✓ A.Safe Attachments
B.Attack surface reduction rules
C.Multi-factor authentication enforcement
✓ D.Safe Links
E.Device compliance policies

Why A: Safe Attachments (A) is a core Microsoft Defender for Office 365 capability that detonates email attachments in a sandbox to detect malicious content before delivery. Safe Links (D) is also a Defender for Office 365 feature that rewrites and checks URLs in email and Office documents at time-of-click to block phishing and malicious destinations. Attack surface reduction rules (B) belong to Microsoft Defender for Endpoint, not Defender for Office 365. Multi-factor authentication enforcement (C) is handled by Microsoft Entra ID (Azure AD) Conditional Access, not Defender for Office 365. Device compliance policies (E) are configured in Microsoft Intune, so they are outside Defender for Office 365's scope.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.

Microsoft Defender for Office 365 Capabilities: Safe Links, Safe Attachments, and Anti-Phishing

Why each option matters

Option-by-option breakdown

Related to this question

2 more ways this is tested on SC-900