Links from Microsoft Teams no longer open in the expected browser

[marcoskirsch]

This used to work, but Microsoft must have changed how they launch URLs.

Before: links would go to Finicky and open in the expected browser.
Now: links presumably go to Finicky but always open in Safari and Safari stays in the background.

Have you tried creating configuration for this application?

I tried changing default browser to Edge, and links from Teams correctly opened in Edge and Edge came to the foreground.
I tried changing default browser to Safari, and links from Teams opened in Safari and Safari stayed in the background !
I tried changing default browser to Finicky and the same incorrect behavior remained.

What application are you trying to set up

I want to click links on Microsoft Teams and have them open in the correct browser per my configuration, which works correctly from other applications including Microsoft ones.

[marcoskirsch]

Perhaps if there is a log on what Finicky processes it may shed some light?

[patrickrushton]

It looks like Teams opens links to a safe-link checker (maybe this is dependent on the organisation)

I seem to be able to redirect all links by matching https://statics.teams.cdn.office.net/*

[jamtur01]

If it helps, this has stung me a bit. When you add a Teams meeting to a calendar invite it now comes with two links, both wrapped in safelinks. The first opens the Teams help page redirect and the second opens the actual meeting. I've found a bunch of tools (BusyCal was one example) are configred to grab the first link in a meeting invite, meaning you always ended up at the redirect page. I initially assumed this was Finicky enable to untangle the link in the safelinks but discovered this twist too.

[thoroc]

What's the process to expose the secondary link then?

[thoroc]

I've got the logs by running: /Applications/Finicky.app/Contents/MacOS/Finicky --dry-run --window and I see that the origin/destination urls are encoded there.

[thoroc]

Here is an example that works for v4:

export const msTeamsHandlerEgress: BrowserHandler = {
  match: (url: URL, { opener }) => {
    return (
      opener?.bundleId === MSTEAMS_APP.bundleId &&
      url.host === 'statics.teams.cdn.office.net' &&
      url.pathname.startsWith('/evergreen-assets/safelinks/1/atp-safelinks.html')
    );
  },
  browser: FIREFOX_APP.bundleId,
};

[afuechsel]

But this is not what I want. I want the links in teams handled with the finicky rules the same way as ususal: some of them should open in Chrome, others in Firefox. Now I cannot do any filtering for these links, due to the safelinks feature. Is there a way to filter out the final URL and create filters based on this?

[thoroc]

I know it is frustrating.

---

Is the target URL not part of the safelink URL?

[afuechsel]

Is the target URL not part of the safelink URL?

Yes, but in a very bad format so I don't know, how to filter them. For example this:

[2025-11-11T10:39:36.179Z] [INFO ] URL received | url: https://statics.teams.cdn.office.net/evergreen-assets/safelinks/2/atp-safelinks.html?url=https%3A%2F%2Fwww.heise.de&locale=de-de&dest=https%3A%2F%2Fteams.microsoft.com%2Fapi%2Fmt%2Fapac%2Fbeta%2Fatpsafelinks%2Fgeturlreputationsitev2%2F&pc=2ZJKH1bhO%252fQ9t0IKIKODdo5OyVJBtA6OtfmY2XsGasoKxrOr%252fznhrUDZtZpvm7pFYw4CUE1oydiYoSdHi2IL%252fkXf70dA4IRYfijkNV97MKFK6ebgemsU50LyQHwRjqDOb4mQov3SF1sOIhTfSOJUdyH4N8AnKAzpZ%252f7Q8KwJb%252bT5%252b2BM...
20httponly&wau=https%3A%2F%2FIND01.safelinks.protection.outlook.com%2FGetUrlReputation&si=1762857573119%3B1762857573119%3B48%3Anotes&sd=%7BconvId%3A%2048%3Anotes%2C%20messageId%3A%201762857573119%7D&ce=prod&cv=50%2F25101616511&ssid=E4307BC6-020A-4E86-8D23-
...

[kcbaltz]

I solved this with a simple matcher rule:

          , "teams.public.onecdn.static.microsoft/evergreen-assets/safelinks/*example.com*"

I put that everywhere I previously had a match like:

       , "example.com*"

Note that the target url is encoded, so I stuck to just the domain name. If you need to match protocol or some part of the path, you may need to allow for that in your regex. E.g. afuechsel's example above has "https%3A%2F%2Fwww.heise.de" instead of "https://www.heise.de".

[jamtur01]

function isValidUrlObject(url) {
  try {
    return Boolean(url && url.host && url.hostname && url.protocol);
  } catch {
    return false;
  }
}

const msTeamsSafelinksRewriter = {
  match: (url) =>
    isValidUrlObject(url) &&
    url.hostname === "statics.teams.cdn.office.net" &&
    url.pathname.startsWith("/evergreen-assets/safelinks/"),
  url: (url) => {
    try {
      // Extract the actual URL from the safelinks wrapper
      const actualUrl = url.searchParams.get("url");
      if (actualUrl) {
        const decodedUrl = decodeURIComponent(actualUrl);
        log(`Extracted URL from Teams safelink: ${decodedUrl}`, `Original: ${url.href}`);
        return new URL(decodedUrl);
      }
      log(`No URL parameter found in Teams safelink: ${url.href}`);
      return url;
    } catch (error) {
      log(`Error extracting URL from Teams safelink: ${error.message}`);
      return url;
    }
  },
};

I've not tested this at all. I fixed it personally by parsing it in my calendar app (ItsyCal) and extracting the Teams URL there. That code is here if it's at all helpful.