Check ID: defender_atp_safe_attachments_and_docs_configured
Provider: Microsoft 365
Service: defender
Severity: MEDIUM
Categories: e5
Resource type: NotDefined

​
What this check verifies

Microsoft Defender for Office 365 Safe Attachments for SharePoint, OneDrive, and Microsoft Teams protects organizations from inadvertently sharing malicious files. When enabled, files identified as malicious are blocked and cannot be opened, copied, moved, or shared until further actions are taken by the organization’s security team.

​
Risk

Without Safe Attachments enabled, users may download, sync, or access malicious files from SharePoint, OneDrive, or Teams, potentially leading to malware infections across the organization. If Safe Documents is disabled or users can bypass Protected View, malicious content in Office documents may execute and compromise endpoints.

​
Recommendation

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams along with Safe Documents to protect users from malicious files. Block users from bypassing Protected View warnings for files identified as malicious to maintain defense-in-depth.

​
Remediation

Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB true−EnableSafeDocstrue -EnableSafeDocs true -AllowSafeDocsOpen $false

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_atp_safe_attachments_and_docs_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks