Get-SafeLinksPolicyReport

<#
.SYNOPSIS
    Reports Safe Links policies and their assigned recipients.

.DESCRIPTION
    Lists every Safe Links policy along with the rule that applies it and
    the users, groups or domains it targets, so coverage gaps are easy to
    spot without opening each policy in the Defender portal one at a time.

.EXAMPLE
    .\Get-SafeLinksPolicyReport.ps1

.NOTES
    Requires ExchangeOnlineManagement and an active Connect-ExchangeOnline session
    with Defender for Office 365 permissions.

.AUTHOR
    Shehryar Hassan
#>

$policies = Get-SafeLinksPolicy
$rules = Get-SafeLinksRule

$report = foreach ($policy in $policies) {
    $rule = $rules | Where-Object { $_.SafeLinksPolicy -eq $policy.Identity }
    [pscustomobject]@{
        PolicyName   = $policy.Identity
        IsEnabled    = $rule.State -eq "Enabled"
        AppliesTo    = if ($rule.SentTo) { $rule.SentTo -join ", " } elseif ($rule.RecipientDomainIs) { $rule.RecipientDomainIs -join ", " } else { "Not scoped" }
        ScanUrls     = $policy.ScanUrls
        TrackClicks  = $policy.TrackClicks
    }
}

$report | Format-Table -AutoSize