Turn on the common attachments filter in every anti-malware policy

Description

Every anti-malware policy that applies to users (the default policy, custom policies and the preset policies) has the common attachments filter turned on (EnableFileFilter $true) with at least Microsoft's default list of file types, which includes exe, cmd and vbe. Matching messages are rejected with an NDR (FileTypeAction Reject) or quarantined (Quarantine).

The filter detects the real file type, not only the extension, for the types that support true type matching. Custom policies are enabled and their recipient conditions do not leave users without a policy other than the default one.

Rationale

Executables, scripts, installers and disk images have no place in normal email and are a classic first stage of malware delivery. Blocking them by type stops new samples that signature scanning does not know yet, at no cost to legitimate mail.

Impact

Users can no longer receive the listed file types by email, also from internal senders. Teams that exchange such files (developers, IT) use SharePoint, OneDrive or another approved channel.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Anti-malware and open each policy.
3. Under Protection settings, check that Enable the common attachments filter is selected, that the file type list contains at least the default types, and that When these file types are found is Reject the message with a non-delivery report (NDR) or Quarantine the message.
4. In Exchange Online PowerShell (read-only):

   Get-MalwareFilterPolicy | Format-List Name, EnableFileFilter, FileTypeAction, FileTypes
   Get-MalwareFilterRule | Format-Table Name, State, Priority
   

5. Fail if a policy that applies to users has EnableFileFilter set to False, if FileTypes lacks exe, cmd or vbe or other default types, or if a custom policy is disabled while users depend on it.

Remediation

1. In the Defender portal, open the policy > Edit protection settings.
2. Select Enable the common attachments filter, keep the default file types (select Select file types to add more), choose Reject the message with a non-delivery report (NDR) and save.
3. PowerShell equivalent (Security Administrator):

   Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true -FileTypeAction Reject
   

   Removing types from the list needs -FileTypes with the full list; do not remove default types.

Rollback

Set-MalwareFilterPolicy -Identity <policy> -EnableFileFilter $false (not recommended).

References

• Anti-malware protection for email in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Configure anti-malware policies in EOP Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft 365 security suite baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-205, ORCA-232) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-019 Apply the Standard preset security policy to all recipients
• related CB-M365-MAIL-022 Block an extended list of risky file types in anti-malware policies
• related CB-M365-MAIL-023 Quarantine malware for admins only and notify admins of internal senders

People and lifecycle