feat(m365): add defender_safelinks_policy_enabled security check #9832

andoniaf · 2026-01-20T07:42:52Z

Context

Adds a new security check defender_safelinks_policy_enabled for the m365 provider.

Description

This PR adds a new security check for m365:

Check: defender_safelinks_policy_enabled
Implementation: New check that detects security misconfigurations
Tests: Unit tests covering pass, fail, and no-resources scenarios

Steps to review

Review the check implementation at prowler/providers/m365/services/defender/defender_safelinks_policy_enabled/
Review the metadata file for correct severity, remediation, and compliance mappings
Run the check tests: poetry run pytest tests/providers/m365/services/defender/defender_safelinks_policy_enabled/ -v
Optionally run the check against a test environment

Checklist

Community Checklist

This feature/issue is listed in here or roadmap.prowler.com
Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

Review if the code is being covered by tests.
Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
Review if backport is needed.
Review if is needed to change the Readme.md
Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

Are there new checks included in this PR? Yes
- If so, do we need to update permissions for the provider? Please review this carefully.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Add new security check defender_safelinks_policy_enabled for m365 provider. Includes check implementation, metadata, and unit tests. Related: https://prowlerpro.atlassian.net/browse/PROWLER-707

github-actions · 2026-01-20T07:43:14Z

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

github-actions · 2026-01-20T07:43:45Z

✅ All necessary CHANGELOG.md files have been updated.

codecov · 2026-01-20T07:45:17Z

Codecov Report

❌ Patch coverage is 87.50000% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.56%. Comparing base (6c6a6c5) to head (2b37a20).

❗ There is a different number of reports uploaded between BASE (6c6a6c5) and HEAD (2b37a20). Click for more details.

HEAD has 4 uploads less than BASE

Flag BASE (6c6a6c5) HEAD (2b37a20)

prowler-py3.10-azure 1 0

prowler-py3.11-azure 1 0

prowler-py3.12-azure 1 0

prowler-py3.9-azure 1 0

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #9832       +/-   ##
===========================================
- Coverage   86.60%   76.56%   -10.04%     
===========================================
  Files         222      177       -45     
  Lines        5645     9632     +3987     
===========================================
+ Hits         4889     7375     +2486     
- Misses        756     2257     +1501

Flag	Coverage Δ
prowler-py3.10-azure	`?`
prowler-py3.10-lib	`76.50% <87.50%> (?)`
prowler-py3.10-m365	`88.62% <88.96%> (?)`
prowler-py3.11-azure	`?`
prowler-py3.11-lib	`76.50% <87.50%> (?)`
prowler-py3.11-m365	`88.62% <88.96%> (?)`
prowler-py3.12-azure	`?`
prowler-py3.12-lib	`76.50% <87.50%> (?)`
prowler-py3.12-m365	`88.62% <88.96%> (?)`
prowler-py3.9-azure	`?`
prowler-py3.9-lib	`76.56% <87.50%> (?)`
prowler-py3.9-m365	`88.78% <88.96%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	`76.56% <87.50%> (-10.04%)`	⬇️
api	`∅ <ø> (∅)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-01-20T07:51:09Z

🔒 Container Security Scan

Image: prowler:3b238cf
Last scan: 2026-01-23 14:12:38 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	3
Total	3

3 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

Review the detailed scan results
Update affected packages to patched versions
Consider using a different base image if updates are unavailable

📋 Resources:

Download full report (see artifacts)
View in Security tab
Scanned with Trivy

HugoPBrito

Please also map the check with the corresponding compliances.

prowler/CHANGELOG.md

HugoPBrito · 2026-01-22T14:23:05Z

prowler/lib/powershell/powershell.py

+                    f"or insufficient permissions. Related checks will be skipped."
+                )
+            else:
+                logger.error(f"PowerShell error output: {error_result}")


Since this is an error for a Microsoft specific module, I would add this logic to m365_powershell.py and I would leave this file untouched. We could even add it to all calls having a method that does that.

It returns the original PowerShell error (as it is intended to). Specific integration messages should be in the inteegration file m365_powershell.py.

Address PR #9832 review feedback: - Update CHANGELOG entry to 5.18.0 section - Revert powershell.py to simple error logging - Override read_output() in M365PowerShell with M365-specific cmdlet error handling for missing licensing scenarios

HugoPBrito · 2026-01-23T13:48:13Z

prowler/providers/m365/lib/powershell/m365_powershell.py

+            result = default
+
+        if error_result:
+            self._process_m365_error(error_result)


Please, recreate this method (_process_m365_error) in the original powerhsell.py file, keeping the original handling.

Then, create an @override to that function here. That way we enhance original integration scalability and avoid repeating a lot of code, ensuring best practices.

@OverRide

…override pattern - Create _process_error() method in base PowerShellSession class with generic error messaging for missing cmdlets - Add @OverRide _process_error() in M365PowerShell class with M365-specific messaging about Microsoft Defender for Office 365 licensing - Update changelog with defender_safelinks_policy_enabled entry in v5.18.0

HugoPBrito · 2026-01-26T15:49:28Z

...s/defender/defender_safelinks_policy_enabled/defender_safelinks_policy_enabled.metadata.json

@@ -0,0 +1,40 @@
+{
+  "Provider": "m365",
+  "CheckID": "defender_safelinks_policy_enabled",


Please map the check with its compliance requirements.

HugoPBrito · 2026-01-26T15:56:10Z

...365/services/defender/defender_safelinks_policy_enabled/defender_safelinks_policy_enabled.py

+
+                findings.append(report)
+
+            # Multiple Safe Links Policies


Same thing as #9833 (comment). We should handle with distinction between default, non default, its coverage and priority.

feat(m365): add defender_safelinks_policy_enabled security check

86aef2d

Add new security check defender_safelinks_policy_enabled for m365 provider. Includes check implementation, metadata, and unit tests. Related: https://prowlerpro.atlassian.net/browse/PROWLER-707

andoniaf requested review from a team as code owners January 20, 2026 07:42

github-actions bot added provider/m365 Issues/PRs related with the M365 provider metadata-review labels Jan 20, 2026

andoniaf changed the title ~~feat(m365): add defender_safelinks_policy_enabled security check~~ Draft: feat(m365): add defender_safelinks_policy_enabled security check Jan 20, 2026

andoniaf changed the title ~~Draft: feat(m365): add defender_safelinks_policy_enabled security check~~ feat(m365): add defender_safelinks_policy_enabled security check Jan 20, 2026

andoniaf marked this pull request as draft January 20, 2026 08:25

andoniaf marked this pull request as ready for review January 20, 2026 10:46

andoniaf marked this pull request as draft January 20, 2026 11:59

andoniaf marked this pull request as ready for review January 20, 2026 15:29

This was referenced Jan 20, 2026

feat(m365): add defender_atp_safe_attachments_policy_enabled security check #9837

Open

feat(m365): add defender_zap_for_teams_enabled security check #9838

Merged

HugoPBrito requested changes Jan 22, 2026

View reviewed changes

andoniaf requested a review from HugoPBrito January 23, 2026 13:24

HugoPBrito requested changes Jan 23, 2026

View reviewed changes

andoniaf added 2 commits January 23, 2026 14:59

Merge remote-tracking branch 'origin/master' into feat/PROWLER-707-test

c35c318

andoniaf force-pushed the feat/PROWLER-707-test branch from 0b978d0 to 2b37a20 Compare January 23, 2026 14:03

andoniaf requested a review from HugoPBrito January 23, 2026 14:06

feat: enhance missing module error handling to march standard

e21dfc3

HugoPBrito requested changes Jan 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(m365): add defender_safelinks_policy_enabled security check #9832

feat(m365): add defender_safelinks_policy_enabled security check #9832

andoniaf commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

codecov bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

HugoPBrito left a comment

Uh oh!

Uh oh!

HugoPBrito Jan 22, 2026

Uh oh!

andoniaf Jan 23, 2026

Uh oh!

HugoPBrito Jan 23, 2026

Uh oh!

HugoPBrito Jan 26, 2026

Uh oh!

HugoPBrito Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

feat(m365): add defender_safelinks_policy_enabled security check #9832

Are you sure you want to change the base?

feat(m365): add defender_safelinks_policy_enabled security check #9832

Conversation

andoniaf commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Description

Steps to review

Checklist

SDK/CLI

License

Uh oh!

github-actions bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Container Security Scan

📊 Vulnerability Summary

⚠️ Action Required

Uh oh!

HugoPBrito left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

HugoPBrito Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

andoniaf Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

HugoPBrito Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

HugoPBrito Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

HugoPBrito Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

andoniaf commented Jan 20, 2026 •

edited

Loading

github-actions bot commented Jan 20, 2026 •

edited

Loading

github-actions bot commented Jan 20, 2026 •

edited

Loading

codecov bot commented Jan 20, 2026 •

edited

Loading

github-actions bot commented Jan 20, 2026 •

edited

Loading