Microsoft SafeLinks Is Rewriting Your Marketing Links

Your link doesn't arrive the way you sent it

Send a campaign to a B2B list and a meaningful slice of it lands in Microsoft 365 mailboxes protected by Defender, where SafeLinks has been through the message before anyone reads a word of it. Microsoft's own overview describes exactly what happens to your URLs on the way in: "Scanned URLs are rewritten or wrapped using the Microsoft standard URL prefix: https://<DataCenterLocation>.safelinks.protection.outlook.com."

That's your carefully tagged link, rewrapped in something like nam01.safelinks.protection.outlook.com before a human ever sees it. And this isn't some exotic enterprise configuration you can safely ignore. Microsoft's built-in protection preset applies SafeLinks to every recipient in any organization holding even a single Defender for Office 365 license, including organizations that never configured a policy and don't know the feature exists.

Most marketers have never read what SafeLinks actually does to their campaigns, and we hadn't either, so we read the whole document. It turns out to explain several patterns in B2B email data that otherwise look like random noise. Here's what matters for anyone who measures email.

The three things SafeLinks does to your campaign

First, it rewrites the URL, separately for every recipient. Wrapping happens "per message recipient (both internal and external recipients)," and if someone manually forwards your email, the links inside the forward get rewritten again for the new audience. The recipient still sees your original URL when they hover, because the wrapped link carries your full destination inside it, and that has a consequence worth pausing on: your UTM parameters survive the trip intact. What changes is the path the click takes. Instead of going straight to your site, it routes through Microsoft's checkpoint first, and then on to you.

Second, it checks the link at click time, through an intermediary page. SafeLinks performs what Microsoft calls "time-of-click verification," meaning every click passes through a verification step before your site loads. Microsoft's own Teams documentation admits one odd side effect of that arrangement: the validation page's redirect "is treated as a cross-site request," which can break strict cookies on the destination site. For your analytics, though, the practical effect is simpler and blunter. Untagged links from these emails tend to arrive as referrals from a safelinks subdomain, or as direct traffic, rather than as your campaign. If you've ever found safelinks.protection.outlook.com sitting in your GA4 referral report and wondered how it got there, this is how. You can add those domains to GA4's unwanted referrals list, and we've written about what that setting really fixes, but understand that the exclusion only relabels the traffic. Nothing except parameters in the URL itself can name the campaign, which is one more entry in the long list of reasons tagged links beat referrer data in email.

Third, it clicks your links before your prospect does. Buried in the policy settings is this sentence: "URLs that don't have a valid reputation are detonated asynchronously in the background." Detonated is Microsoft's word for opened and inspected by a machine. Now think about what a fresh campaign looks like from that machine's point of view: a brand-new landing page, no reputation history, arriving in thousands of protected mailboxes at once. The result is a wave of automated fetches that look like engagement in the first hours after a send. We covered the ESP side of this phenomenon in link clicks vs GA4 sessions, where the machines were anonymous scanner infrastructure. SafeLinks is one of those machines with a name and documentation, and new URLs get its attention the hardest.

The variations that make debugging maddening

Nothing about SafeLinks is uniform across a mailing list, and that's why the symptoms feel so random when you try to chase them down.

Some tenants enable the setting Microsoft calls "Do not rewrite URLs, do checks via SafeLinks API only," which means their users see your clean original URLs while the clicks still get checked silently in supported Outlook clients. Some administrators maintain a "Do not rewrite the following URLs" list, and your domain might be on it at one client and absent at the next. Teams is different from email again: links pasted into Teams chats are checked at click time, but as Microsoft puts it, "URLs are not rewritten" there at all.

So the same campaign, sent to five companies, can produce five different measurement fingerprints. One shows a scanner spike in the first hour. One shows safelinks referrals. Three look completely normal. None of that variation is your ESP's fault, and none of it is yours, but if you don't know the mechanism you'll burn an afternoon looking for a bug in your own tagging that isn't there.

What to actually do about it

The first thing to accept is that you can't fight the rewriting. It's another company's security stack, there's no opt-out for senders, and asking your recipients' IT departments to allowlist your domain doesn't scale past a handful of enterprise accounts you know personally.

What you can do is work with the thing that survives the checkpoint, which is the URL itself.

• Tag every email link, without exception. Parameters ride inside the wrapper untouched, and referrers don't reliably survive it. Email to B2B lists is the one channel where skipping UTMs doesn't just degrade your attribution, it guarantees misattribution.
• Give new landing pages a warm-up window before you judge them. First-day click counts on a fresh URL sent to corporate lists run hot, and a chunk of that heat is detonation rather than interest. Comparing day-one clicks to day-three conversions on a brand-new page will make the page look broken when it's actually fine.
• Learn to recognize the machine's signature. Sub-second sessions arriving from Microsoft infrastructure, clustered right after the send, on a campaign whose clicks and conversions tell wildly different stories.
• Protect your sending domain's reputation, because SafeLinks decides how aggressively to treat a URL partly on reputation, and the failure mode is severe: a link that trips its warnings shows your prospect a full-page Microsoft security alert with your URL in the middle of it. We've written about why the sending domain matters for deliverability, and this is the same asset paying rent in a second place.

The corporate inbox stopped being a neutral pipe years ago. If there are B2B addresses on your list, some of your clicks are machines, some of your referrers are Microsoft, and your campaign math should assume the checkpoint is there, because it is.