All links going through Office365 will be scanned by ATP. The URL will be scanned and rewritten as shown below.
The URL will change even if the links are safe and will still take you to the desired webpage. This URL change will apply to received emails to all users.
The URL will change if the link is unsafe. If you accidentally click on the link, you will see the following:
All attachments going through Office365 will be scanned for malware by ATP. If ATP suspects malware in an attachment, it will still deliver the message but block the attachment.
If an attachment is scanned as malicious, the following message will show:
Last Modified: 5/11/2018