Security Policy Errors

Fix Safe Links Rewriting URLs Despite Exclusion Policy in Office 365

Chanuka Geekiyanage Oct 1, 2026 869 views

Question details

Users need to stop Microsoft Defender Safe Links from rewriting specific URLs when an exclusion policy is already applied.

Fix Safe Links Rewriting URLs Despite an Exclusion Policy

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Administrators are trying to whitelist or exclude specific internal or trusted URLs from being rewritten by the Safe Links security feature.
Observed behavior: Safe Links continues to rewrite the URLs because the configured exclusion rules do not correctly cover subpaths, redirects, subdomains, or HTTP/HTTPS protocol changes.

Before you start

Ensure you have Microsoft 365 Security Administrator or Global Administrator privileges to view and modify Defender policies in the Microsoft 365 Defender portal.

Solution 1Recommended

Update Safe Links Exclusions with Wildcards

Modify your existing Safe Links policy to include wildcards and account for URL variations.

Often, Safe Links exclusions fail because they are too restrictive. A policy excluding 'https://contoso.com/a' will not exclude 'https://contoso.com/a/b'. Using wildcards ensures all subpaths are properly bypassed.

Access Safe Links Policies

Edit the Exclusion List

Select your active Safe Links policy, click 'Edit protection settings', and locate the 'Do not rewrite the following URLs' section.

Add Wildcards to URLs

Modify your URLs by adding an asterisk (*) to cover subpaths. For example, change 'https://contoso.com/a' to 'https://contoso.com/a/*'.

Include Protocol Variations

Ensure you add variations of the URL that include both 'http://' and 'https://', as well as any subdomains or redirect URLs that might be involved.

Update Safe Links Exclusions with Wildcards

Policy Application Time: It may take up to 24 hours for modifications in Safe Links policies to fully propagate across your organization.

Solution 2

Submit False Positive and Update Tenant Allow List

Use this solution if URL exclusions are correctly formatted with wildcards but the links are still being rewritten or blocked.

Free Microsoft Office alternative

Switch to WPS Office for a Streamlined Experience

Enterprise security settings like Safe Links rewriting in Microsoft 365 can be overly complex and difficult to manage. If you are looking for a reliable, offline-capable productivity suite that doesn't rely on complicated backend URL rewriting, WPS Office is an excellent free alternative. It provides powerful word processing, spreadsheet, and presentation tools without the administrative overhead.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the Software: Run the installer and follow the on-screen prompts to set up WPS Office on your computer in just a few minutes.
3. Open and Edit Documents: Launch WPS Office and instantly open your existing Microsoft Office files without worrying about broken links or restricted access.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Free, lightweight, and fast to launch on any deviceAvoid complex administrative security policies like Safe Links configurationFamiliar user interface for seamless and immediate migration

microsoft office alternative - wps office

Frequently Asked Questions

Why does Safe Links rewrite URLs that are on my exclusion list?

This usually happens because the exclusion list is too specific. If a URL redirects, changes from HTTP to HTTPS, or includes additional subpaths not covered by a wildcard (*), Safe Links will continue to rewrite it.

How do I correctly format wildcards in Safe Links exclusions?

To include all subpaths, append '/*' to the end of your directory URL. For example, 'https://contoso.com/approval/*' will ensure any file or path under the 'approval' directory is not rewritten.

What information does Microsoft Support need if exclusions still fail?

You should provide the original intended URL, the rewritten Safe Links URL, and any Safe Links trace information gathered from your message traces to help them investigate the false positive.

Microsoft Office Security Issues