

Messages that contain malicious attachments are quarantined. Notifies recipients that attachments have been removed. This is the default value, and the recommended value in Standard and Strict preset security policies. Protects your organization from repeated attacks using the same malware attachments. *Īutomatically blocks future instances of the messages and attachments. By default, only admins (not users) can review, release, or delete the messages. Prevents messages with detected malware attachments from being delivered. See where detected malware goes in your organization. You should only use this option to turn off Safe Attachments scanning for recipients who only receive messages from trusted senders.ĭelivers messages with attachments and then tracks what happens with detected malware.ĭelivery of safe messages might be delayed due to Safe Attachments scanning. This option is not recommended for most users. Prevent unnecessary delays in routing internal mail. Turn scanning off for selected recipients. Messages are still scanned for malware by anti-malware protection in EOP. The available options are described in the following table:Īttachments aren't scanned for malware by Safe Attachments. Safe Attachments unknown malware response: This setting controls the action for Safe Attachments malware scanning in email messages. This section describes the settings in Safe Attachments policies:


The following table describes scenarios for Safe Attachments in Microsoft 365 and Office 365 organizations that include Microsoft Defender for Office 365 (in other words, lack of licensing is never an issue in the examples).

For instructions, see Set up Safe Attachments policies in Defender for Office 365. There is no default Safe Attachments policy, so to get the protection of Safe Attachments, you need to create one or more Safe Attachments policies. Safe Attachments protection for email messages is controlled by Safe Attachments policies. Specifically, Safe Attachments uses a virtual environment to check attachments in email messages before they're delivered to recipients (a process known as detonation). Safe Attachments in Microsoft Defender for Office 365 provides an additional layer of protection for email attachments that have already been scanned by anti-malware protection in Exchange Online Protection (EOP). Microsoft Defender for Office 365 plan 1 and plan 2.This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. The improved Microsoft 365 Defender portal is now available.
