Safe Attachments SHALL Be Enabled
Description
The Safe Attachments will scan messages for attachments with malicious content. It routes all messages and attachments that do not have a virus/malware signature to a special environment. The process then uses machine learning and analysis techniques to detect malicious intent. Enabling this feature may slow down message delivery to the user due to the scanning.
Policy
At least one Safe Attachments Policy SHALL include all agency domains—and by extension—all users.
The action for malware in email attachments SHALL be set to block.
Redirect emails with detected attachments to an agency-specified email SHOULD be enabled.
Licensing Considerations
This setting requires Defender for Office 365 Plan 1 or Plan 2 which can be purchased standalone or as part of the following bundles:
Defender for Office 365 Plan 1/2
Microsoft 365 Business Premium
Office 365 E5/A5/G5
Microsoft 365 E5/A5/G5
Microsoft 365 E5/A5/G5 Information Protection and Governance
Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance
Set Up Instructions
Sign in to Microsoft 365 Defender.
Under Email & collaboration, select Policies & rules.
Select Threat policies.
Under Policies, select Safe Attachments.
Click Create to start a new policy.
Give the new policy an appropriate name and description.
Under domains, enter all organization tenant domains. All users under these domains will be added to the policy.
Under Safe Attachments unknown malware response, select Block.
Set the Quarantine policy to AdminOnlyAccessPolicy.
Click Next, then Submit.
End-User Impact
With this setting in place, there may be some latency in email flow while the attachment is being scanned before delivery. If the attachment is found to be malicious, the email will be blocked from sending.
PowerShell Scripts
Videos
Last updated