Most Microsoft 365 tenants configure Safe Links and Safe Attachments like they're one setting. Safe Links rechecks every clicked URL for as long as a message exists. Safe Attachments checks a file once, at delivery, then stops. For security architects running Defender for Office 365, this covers where each control's coverage ends, a real Teams misconfiguration that let a phishing link through, and the checklist to close both gaps.