Creating a custom (copied) payload in Microsoft Defender, I select 'Change URL' to change the phishing link but the new/different URL will not save/apply

Question

I am creating a custom payload in Microsoft Defender, copied from an existing payload (Microsoft Sharepoint shared documents notifications [DriveByUrl] English) and then modified to be customised wording.

As part of the editing/setup process you can (seemingly) change the URL that the Phishing link will take users to when they click the link inside the email.

I wish to change this link to something more likely to fool a user for the email content type.

So this example is a Sharepoint document share phishing email. The current (default) url link the user will be taken to is 

I wish for it to instead to be taken to another Microsoft owned phishing link url out of the list that is more likely to trick the users. I would like it to instead be the URL pictured below:

During the payload editing process I click 'Change URL'

I select my preferred URL from the list and click CONFIRM at the bottom

I am taken back to the main page and the URL has NOT changed.

Even if I proceed and then test the phishing scam after saving it (in case it has actually changed but just has not updated on that setup page) it's still linking the phishing email to the original URL 

=

It is NOT actually changing it.  (there is no error or pop up at any point to indicate any issue either) 

 

This happens whether I edit the existing customised payload or create another new one cpiied from the sample and change the url right at the start before saving it. 

 

Answer 1

@Megan Cole, From your description, the issue is related with Microsoft Defender. If you are using Microsoft Defender for Endpoint, you can open case via the steps in the following link to get help.

https://learn.microsoft.com/en-us/defender-endpoint/contact-support

Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.