{
  "id": "CB-M365-MAIL-025",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-025",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-025.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-025.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-025",
    "title": "Detonate email attachments with Safe Attachments set to Block for all recipients",
    "finding": {
      "title": "Email attachments are not detonated, or detected ones are still delivered",
      "description": "New malware that no signature knows yet reaches users inside attachments, because no Safe Attachments policy blocks it for every recipient."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-office-365",
      "safe-attachments",
      "sandboxing",
      "malware",
      "attachments"
    ],
    "applicability": {
      "requires": [
        "Microsoft Defender for Office 365 Plan 1"
      ]
    },
    "description": "Every recipient is covered by a Safe Attachments policy (the Standard or Strict preset, or a\ncustom policy) with:\n\n- **Safe Attachments unknown malware response** set to **Block** (`Enable $true`, `Action Block`);\n- quarantine policy **AdminOnlyAccessPolicy** (`QuarantineTag`);\n- recipient conditions that cover every accepted domain, with no exceptions other than\n  documented service mailboxes.\n\nNo mail flow rule skips Safe Attachments processing (rules that set the\n`X-MS-Exchange-Organization-SkipSafeAttachmentProcessing` header).\n",
    "rationale": "Safe Attachments opens attachments in a sandbox and watches their behavior, which catches new\nand targeted malware that signature scanning misses. With **Block**, detected messages are\nquarantined instead of being delivered; **Monitor** or **Off** only report. A single bypass rule\nor a missing domain in the conditions leaves a hole that attackers find.\n",
    "impact": "Messages with attachments can be delayed while they are scanned (usually under a few minutes).\nMessages with detected attachments go to admin-only quarantine.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Safe\n   Attachments**. Check that the **Standard Preset Security Policy** (or **Strict**) or a custom\n   policy is on and applies to all recipients, with **Safe Attachments unknown malware response**\n   set to **Block** and **Quarantine policy** **AdminOnlyAccessPolicy**.\n3. In the Exchange admin center, **Mail flow** > **Rules**, look for rules that set the header\n   `X-MS-Exchange-Organization-SkipSafeAttachmentProcessing`.\n4. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-SafeAttachmentPolicy | Format-Table Name, Enable, Action, QuarantineTag, IsBuiltInProtection\n   Get-SafeAttachmentRule | Format-List Name, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*\n   Get-TransportRule | Where-Object { $_.SetHeaderName -like '*SkipSafeAttachmentProcessing*' } | Format-Table Name, State\n   ```\n5. Fail if some recipients are only covered by a policy with `Enable $false` or `Action` other\n   than `Block` (`Monitor`, `Allow`), or if a mail flow rule skips Safe Attachments.\n"
    },
    "remediation": {
      "manual": "1. Prefer the preset: apply the Standard preset to all recipients (CB-M365-MAIL-019).\n2. For a custom policy, in **Safe Attachments** select **Create** (or edit), set the users and\n   domains to all accepted domains, **Safe Attachments unknown malware response** to **Block**,\n   **Quarantine policy** to **AdminOnlyAccessPolicy**, and save.\n3. PowerShell equivalent (Security Administrator):\n   ```powershell\n   Set-SafeAttachmentPolicy -Identity \"<policy>\" -Enable $true -Action Block -QuarantineTag AdminOnlyAccessPolicy\n   ```\n4. Remove or rewrite the mail flow rules that skip Safe Attachments.\n",
      "rollback": "Set the custom policy back to its previous action, or turn it off; the Built-in protection\npreset still applies.\n"
    },
    "references": [
      {
        "title": "Safe Attachments in Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/safe-attachments-about",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set up Safe Attachments policies in Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/safe-attachments-policies-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-124, ORCA-227, ORCA-189)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-44",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-019",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-026",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}