Safe Attachments policy is enabled with secure configuration

​

What this check verifies

Microsoft Defender for Office 365 Safe Attachments provides an additional layer of protection by scanning email attachments in a secure environment before delivering them to recipients. The Built-In Protection Policy should have Enable=True, Action=Block, and QuarantineTag=AdminOnlyAccessPolicy to ensure malicious attachments are blocked and quarantined with admin-only access.

​

Risk

Without properly configured Safe Attachments policies, malicious email attachments could reach users’ mailboxes and potentially compromise the organization through:

• Malware delivery via infected documents
• Ransomware attacks through weaponized attachments
• Data exfiltration using malicious scripts

​

Recommendation

Enable Safe Attachments with the Block action to prevent malicious attachments from reaching users. Use AdminOnlyAccessPolicy for the quarantine tag to ensure only administrators can release quarantined items, following the principle of least privilege.

​

Remediation

​

References

• https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about
• https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_safe_attachments_policy_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks