When a link within an e-mail message is sent to your address, ATP will scan the URL in real time. The URL will be re-written to show the following path:

http://na01.safelinks.protection.outlook.com...

When you click on a link, the browser will redirect through Microsoft Safe Links servers that scan the link.

If Microsoft deems a link malicious, you will see the following screen after clicking the URL.