The worst is that they set up outlook to obfuscate all urls, so you can’t even validate by eye.

I work in cybersecurity and this sort of thing drives me straight up a wall. I understand why these sort of things exist, but they fail so often that they are worthless. My work has the Microsoft “urldefense” bullshit URL mangling. As far as I can tell, it has never stopped someone from clicking on a phishing email. In fact, since the URL now looks like a Microsoft URL, users think they are safe to click on. All the money and effort for training, right in the shit can. Thanks Microslop!