Detonate email attachments with Safe Attachments set to Block for all recipients

Description

Every recipient is covered by a Safe Attachments policy (the Standard or Strict preset, or a custom policy) with:

• Safe Attachments unknown malware response set to Block (Enable $true, Action Block);
• quarantine policy AdminOnlyAccessPolicy (QuarantineTag);
• recipient conditions that cover every accepted domain, with no exceptions other than documented service mailboxes.

No mail flow rule skips Safe Attachments processing (rules that set the X-MS-Exchange-Organization-SkipSafeAttachmentProcessing header).

Rationale

Safe Attachments opens attachments in a sandbox and watches their behavior, which catches new and targeted malware that signature scanning misses. With Block, detected messages are quarantined instead of being delivered; Monitor or Off only report. A single bypass rule or a missing domain in the conditions leaves a hole that attackers find.

Impact

Messages with attachments can be delayed while they are scanned (usually under a few minutes). Messages with detected attachments go to admin-only quarantine.

Applies when

Requires: Microsoft Defender for Office 365 Plan 1

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Safe Attachments. Check that the Standard Preset Security Policy (or Strict) or a custom policy is on and applies to all recipients, with Safe Attachments unknown malware response set to Block and Quarantine policy AdminOnlyAccessPolicy.
3. In the Exchange admin center, Mail flow > Rules, look for rules that set the header X-MS-Exchange-Organization-SkipSafeAttachmentProcessing.
4. In Exchange Online PowerShell (read-only):

   Get-SafeAttachmentPolicy | Format-Table Name, Enable, Action, QuarantineTag, IsBuiltInProtection
   Get-SafeAttachmentRule | Format-List Name, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*
   Get-TransportRule | Where-Object { $_.SetHeaderName -like '*SkipSafeAttachmentProcessing*' } | Format-Table Name, State
   

5. Fail if some recipients are only covered by a policy with Enable $false or Action other than Block (Monitor, Allow), or if a mail flow rule skips Safe Attachments.

Remediation

1. Prefer the preset: apply the Standard preset to all recipients (CB-M365-MAIL-019).
2. For a custom policy, in Safe Attachments select Create (or edit), set the users and domains to all accepted domains, Safe Attachments unknown malware response to Block, Quarantine policy to AdminOnlyAccessPolicy, and save.
3. PowerShell equivalent (Security Administrator):

   Set-SafeAttachmentPolicy -Identity "<policy>" -Enable $true -Action Block -QuarantineTag AdminOnlyAccessPolicy
   

4. Remove or rewrite the mail flow rules that skip Safe Attachments.

Rollback

Set the custom policy back to its previous action, or turn it off; the Built-in protection preset still applies.

References

• Safe Attachments in Microsoft Defender for Office 365 Microsoft, vendor-doc, accessed 2026-10-24
• Set up Safe Attachments policies in Microsoft Defender for Office 365 Microsoft, vendor-doc, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-124, ORCA-227, ORCA-189) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-019 Apply the Standard preset security policy to all recipients
• related CB-M365-MAIL-026 Scan SharePoint, OneDrive and Teams files with Safe Attachments and block infected downloads

People and lifecycle