Microsoft 365 Safe Links, the feature that rescans a link the moment someone clicks it, is not included in every Microsoft 365 plan. It comes with Microsoft 365 Business Premium and, as of July 1, 2026, with Office 365/Microsoft 365 E3, but Business Basic and Business Standard are left out. If your Southwest Florida business runs on Business Standard, the plan most small companies actually buy, your email links get scanned once on arrival and never again.
- Safe Links (part of Microsoft Defender for Office 365 Plan 1) rechecks a URL at the moment of the click, not just when the email lands in the inbox.
- Business Premium includes it. Business Basic and Business Standard do not, and never have.
- Attackers know this. A link can pass initial scanning clean, then get weaponized hours or days later, after the message has already been delivered.
- Ransomware groups are increasingly hitting smaller companies: disclosed victims rose 24.9% year over year, and the $1M-$5M revenue band nearly doubled its share of cases, according to Black Kite’s 2026 Ransomware Report.
- You can close this gap by upgrading to Business Premium, buying the Defender for Office 365 Plan 1 add-on, or layering a third-party email security tool on top of Standard.
What does time-of-click link protection actually do?
A standard Microsoft 365 mailbox scans a link for known bad domains when the email arrives. That check happens once. Safe Links, part of Microsoft Defender for Office 365 Plan 1, wraps every link so it gets rechecked in real time at the moment someone actually clicks, whether that’s five minutes or five days after delivery. If the destination has turned malicious since the email arrived, Safe Links blocks it and shows a warning page instead.
This matters because a lot of phishing infrastructure is built to pass the first scan. A page sits blank or redirects to something harmless for the first few hours, then flips to a credential-harvesting or malware page once it’s past automated filters and sitting in inboxes. One-time scanning misses that switch entirely. Time-of-click scanning catches it.
Which Microsoft 365 plans actually include it?
According to Microsoft’s own service description for Defender for Office 365, Plan 1 (Safe Links, Safe Attachments, real-time detections, anti-phishing policies) is included in Microsoft 365 Business Premium. It was added to Office 365 E3 and Microsoft 365 E3 starting July 1, 2026. Business Basic and Business Standard, the two plans most small businesses default to because they’re the cheapest options with a real Office license, are not on that list. Those plans run on Exchange Online Protection alone, which does the one-time scan at delivery and stops there.
If you’re not sure which plan your business is on, an admin can check under Billing > Your Products in the Microsoft 365 admin center, or your IT provider can pull it in under a minute.
Why does this matter more for small businesses right now?
Ransomware groups aren’t chasing headline-grabbing enterprise targets the way they were a few years ago. Black Kite’s 2026 report tracked 7,551 disclosed ransomware victims between April 2025 and March 2026, and found the mid-market and small-revenue bands, not the largest companies, drove most of the year’s growth. Qilin, one of the most active groups this year, grew from 250 to 1,358 disclosed victims, a 443% jump, much of it aimed at smaller organizations and the vendors that support them. Phishing is still the most common way these groups get their first foothold. A business running Business Standard with no time-of-click protection is exactly the kind of easier entry point that trend describes.
We’ve written before about how ransomware crews are targeting Southwest Florida small businesses specifically, and about tightening up your Microsoft 365 security settings for the year ahead. Safe Links coverage is one of the gaps worth checking as part of that review.
What are the options if you’re on Business Standard?
You have three practical paths. First, upgrade the mailboxes that handle the most external email, sales, accounts payable, front office, to Business Premium, which brings Safe Links, Safe Attachments, and better device management along with it. Second, buy the Defender for Office 365 Plan 1 add-on for your existing Standard licenses if a full upgrade doesn’t make sense for every seat. Third, layer a third-party email security product on top of Standard if you have reasons to stay off Business Premium, though this usually costs more than the native add-on once you count setup and management time.
Whichever route you pick, pair it with basic user training. Time-of-click protection stops a lot of attacks, but it isn’t a reason to skip multi-factor authentication or to let staff click first and think later.
Frequently asked questions
Does Microsoft 365 Business Premium include Safe Links automatically?
Yes. Business Premium includes Defender for Office 365 Plan 1, which covers Safe Links and Safe Attachments, with no separate add-on purchase required.
Can I add Safe Links to Business Standard without upgrading every mailbox?
Yes. The Defender for Office 365 Plan 1 add-on can be licensed per mailbox, so you can cover the accounts most exposed to external email without moving your whole tenant to Business Premium.
Does Exchange Online Protection already stop phishing links?
It stops known-bad links at the moment of delivery. It does not recheck a link later, so a page that turns malicious after the email lands will get through unless Safe Links is in place.
How do I find out which Microsoft 365 plan my business is on?
A global admin can check under Billing > Your Products in the Microsoft 365 admin center. If you don’t manage this in-house, your IT provider can confirm it quickly.
Not sure whether your mailboxes have time-of-click protection, or want a second set of eyes on your Microsoft 365 security settings before hurricane season traffic picks up? SWFIT offers a free 15-minute IT and security review for Southwest Florida businesses. Get in touch to schedule yours.
SWFIT
