When you share a link to a recorded Teams meeting, recipients may see a Safe Links warning that blocks the URL, even though the link is valid and the recording is accessible. This warning appears because Microsoft 365 Defender scans every URL in Teams messages and applies your organization’s Safe Links policy. The block often happens when the recording link contains a long query string or a custom domain that the policy flags as unverified. This article explains why Safe Links blocks valid recording URLs and provides the exact steps to allow the link through while keeping your security settings intact.
Key Takeaways: Allowing a Blocked Teams Recording Link
- Microsoft 365 Defender > Email & collaboration > Policies & rules > Threat policies > Safe Links: Shows the policy that decides which URLs are blocked or allowed.
- Safe Links policy > Protect > URL & click protection settings: Lets you add a custom allowed URL that bypasses the warning for your recording link.
- Teams admin center > Meetings > Meeting settings > Recording: Controls the default recording storage location, which determines the link format that Safe Links scans.
Why Safe Links Blocks a Valid Recording URL
Safe Links is a feature in Microsoft Defender for Office 365 that checks every URL in Teams messages, email, and other Microsoft 365 apps. When a user clicks a link, the service re-writes the URL to route it through Microsoft’s scanning service. If the service cannot verify the final destination, it shows a warning page instead of opening the link.
A Teams recording link is not a simple URL. It points to a stream or OneDrive location and includes parameters such as ?recordingId= or ?playback=. These long query strings can trigger Safe Links because the service treats the entire URL, including the parameters, as the destination. If your organization uses a custom domain for the recording storage, such as a SharePoint site with a vanity URL, Safe Links may not recognize that domain as trusted.
Another common cause is that the Safe Links policy is set to On for all users, and the policy’s action is Block rather than Redirect. When the action is set to Block, any URL that fails verification is blocked immediately. When the action is Redirect, the user sees a warning but can click through after confirming the link is safe.
The block is not a sign that the recording is broken. It is a policy decision based on the link’s structure and the configured trust rules. You can fix it by adjusting the Safe Links policy, adding an allowed URL, or changing how you share the link.
How Safe Links Re-writes the URL
When Safe Links is enabled, the URL in the Teams message is replaced with a Microsoft-owned URL that looks like https://nam02.safelinks.protection.outlook.com/?url=.... This re-write happens automatically. If the original URL contains characters that are not allowed in the re-written format, such as spaces or unencoded ampersands, the scan fails and the warning appears.
Steps to Allow a Blocked Teams Recording Link
Follow these steps in order. The first method fixes the block for a single URL. The second method changes the policy for all users. The third method avoids the block entirely by using a different sharing method.
Method 1: Add the Recording URL to the Safe Links Allow List
- Open the Microsoft 365 Defender portal
Go to security.microsoft.com and sign in with an account that has the Security Administrator or Global Administrator role. - Navigate to Safe Links policies
In the left navigation, select Email & collaboration > Policies & rules > Threat policies > Safe Links. - Select the policy that applies to your users
Click the policy name. If you have multiple policies, choose the one that has the highest priority for the affected user. The priority is shown in the Priority column. - Open the URL & click protection settings
In the policy details page, find the section called URL & click protection settings. Click Edit. - Add the recording URL to the allow list
In the Do not rewrite the following URLs field, paste the full recording link that was blocked. Click Add. - Save the policy
Click Save at the bottom of the page. Wait 30 to 60 minutes for the change to propagate across Microsoft 365. - Test the link again
Send the link in a new Teams message and click it. The warning should no longer appear.
Method 2: Change the Safe Links Policy Action to Redirect
- Open the same Safe Links policy
Repeat steps 1 through 3 from Method 1. - Edit the URL & click protection settings
Click Edit next to URL & click protection settings. - Change the action for unknown URLs
Under What do you want to do with potentially malicious URLs?, select Redirect the URL to the Safe Links service. This option is the default. If it is already selected, the block comes from the Block the following URLs list. Remove any entry that matches your recording domain. - Enable the click-through confirmation
Check the box for Show the organization branding on warning and notification pages if you want users to see a warning but still be able to continue. This option does not block the link; it only shows a caution. - Save the policy
Click Save and wait for propagation.
Method 3: Share the Recording with a Direct Link
- Open the recording in Teams
Go to the meeting chat and click the recording thumbnail. The recording opens in the Teams web player. - Copy the stream URL instead of the Teams link
In the web player, click the Share icon and choose Copy link. This URL points directly to the stream or OneDrive file and is shorter than the Teams chat link. - Send the direct link
Paste the copied link into a Teams message. Test it to confirm that Safe Links does not block it.
If Teams Still Shows the Warning After the Main Fix
The warning appears only on mobile devices
The mobile Teams app uses a different URL scanning process. The allow list in the Safe Links policy applies to all clients, but the mobile app may cache the block. Close the Teams app completely and reopen it, then click the link again.
The recording link works in a browser but not inside Teams
When you click a link inside Teams, the client re-writes the URL for tracking. If the original link contains a comma or a semicolon, the re-write can break the URL. Use the direct stream link from Method 3 instead of the chat link.
The block appears for only one recipient
The recipient may have a different Safe Links policy assigned. Check the recipient’s policy assignment in the Microsoft 365 Defender portal under Email & collaboration > Policies & rules > Threat policies > Safe Links. The policy with the lowest priority number applies first.
The URL contains a custom domain that is not in the allow list
If your organization uses a custom domain for SharePoint or OneDrive, add that domain to the allow list in the Safe Links policy. In the Do not rewrite the following URLs field, enter the domain without a path, such as contoso.sharepoint.com. This allows all links on that domain, including recording links.
Safe Links Policy Options vs Direct Sharing: Key Differences
| Item | Allow List in Safe Links | Direct Stream Link |
|---|---|---|
| Security level | Keeps scanning for all other URLs | Bypasses Safe Links entirely for that link |
| Setup time | 5 minutes in Defender portal | 1 minute in Teams |
| Applies to | All users under the policy | Only the person who sends the link |
| Link format | Original Teams chat link | Short stream or OneDrive link |
| Risk of block | Low after allow list is saved | Very low |
Conclusion
You can now unblock a valid Teams recording link by adding it to the Safe Links allow list or by changing the policy action to Redirect. Test the link after each change to confirm the warning is gone. If the block persists, use the direct stream link from the Teams web player. Remember to check the recipient’s policy priority first, because a higher-priority policy can override your allow list. For ongoing issues, review the Safe Links reporting in the Defender portal to see the exact reason for the block.