Which Defender Protects Against Malicious Links in Email, Chat, and Channels?

Why the Answer Is Correct

Microsoft Defender for Office 365 is the workload that delivers Safe Links, which rewrites inbound URLs during mail flow and performs time-of-click verification of links in email, Microsoft Teams messages, and channels. Because a malicious link can be sent clean and weaponized later, detonation-on-click is exactly the control the scenario describes. Safe Links also covers supported Office apps such as Word, Excel, and PowerPoint, keeping the protection consistent wherever a user clicks. That makes B the only option that maps directly to "malicious links in email messages, chat messages, and channels."

Why the Other Options Are Wrong

Microsoft Defender for Cloud Apps (A) is a Cloud Access Security Broker focused on shadow IT discovery, SaaS session policies, and anomalous behaviour in cloud apps, and it does not rewrite or detonate URLs inside Exchange mail flow or Teams chats. Microsoft Defender for Endpoint (C) is endpoint detection and response, protecting devices from malware and post-exploitation behaviour rather than screening message-borne links. Microsoft Defender for Identity (D) monitors on-premises Active Directory signals for identity-based attacks and has no URL reputation component at all.

Community Comment Notes

Every learner record on this page selects B, and the reasoning is consistent with the vendor documentation. As chiliman explains, the feature behind the scenario is Safe Links, offering "time-of-click verification of URLs and links in email messages, Teams" plus scanning and rewriting of inbound mail. LegendaryZA and KindFlame simply confirm the same pick with no dissent, so the community consensus and the technical analysis agree here.