M365EXO-004: Safe Attachments policy
- Platform
- Entra ID / M365
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Safe Attachments in Microsoft Defender for Office 365 detonates email attachments in a sandbox environment to detect zero-day malware and advanced threats that signature-based scanning cannot identify. Without Safe Attachments enabled, novel malware variants delivered as email attachments may bypass traditional anti-malware filters. This defense layer is critical for organizations targeted by sophisticated adversaries using custom or polymorphic malware.
Recommended value
Safe Attachments enabled in Dynamic Delivery mode for all users; global settings enabled for SharePoint, OneDrive, and Teams
Remediation
Create or update the Safe Attachments policy to use Dynamic Delivery mode, which delivers the email body immediately while attachments are scanned, minimizing user impact while maintaining protection. Enable Safe Attachments for SharePoint, OneDrive, and Teams in the global settings to extend file detonation protection beyond email. Assign the policy to all users and monitor the Threat Explorer for detections to validate policy effectiveness.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.DEFENDER.3.1v1
- NIST SP 800-53
- SI-3
- CIS M365 Benchmark
- 2.1.4