Email is still where attacks start, and a decade of this product (back when it was called ATP) has made one thing clear: Safe Links and Safe Attachments catch the things users click before users can click them.
Out of the box it's mediocre. The preset security policies fixed most of that, but impersonation protection still needs per-tenant tuning, every VIP and supplier list is different.
Verdict: non-negotiable on every tenant we manage. Tuned, it's the highest-value control in the stack.
Reviewed from live fleet experience · published June 2026 · we earn a fair margin on some products we supply; reviews are not sponsored.
