Scan SharePoint, OneDrive and Teams files with Safe Attachments and block infected downloads

Description

Two settings are on:

• Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams in the Safe Attachments global settings (EnableATPForSPOTeamsODB $true);
• SharePoint prevents users from downloading files that Defender detected as malicious (DisallowInfectedFileDownload $true).

Rationale

Collaboration storage is a common way to spread malware inside the organization and to partners: a file shared from a trusted tenant does not go through email filtering. Scanning catches it, and blocking the download stops users from opening it anyway.

Impact

Users cannot download, open in the desktop app, copy or sync files flagged as malicious; they can still delete them. Administrators can release false positives from quarantine.

Applies when

Requires: Microsoft Defender for Office 365 Plan 1

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Safe Attachments > Global settings and check that Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams is on.
3. In Exchange Online PowerShell (read-only):

   Get-AtpPolicyForO365 | Format-List EnableATPForSPOTeamsODB
   

4. In SharePoint Online Management Shell (Get-SPOTenant requires the SharePoint Administrator role; there is no read-only role for it):

   Get-SPOTenant | Format-List DisallowInfectedFileDownload
   

5. Fail if either value is False.

Remediation

1. In the Defender portal, Safe Attachments > Global settings, turn on Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams and save. PowerShell equivalent (Security Administrator):

   Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true
   

2. In SharePoint Online Management Shell (SharePoint Administrator):

   Set-SPOTenant -DisallowInfectedFileDownload $true
   

Rollback

Set-SPOTenant -DisallowInfectedFileDownload $false.

References

• Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams Microsoft, vendor-doc, accessed 2026-10-24
• Set-AtpPolicyForO365 Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft 365 security suite baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-025 Detonate email attachments with Safe Attachments set to Block for all recipients
• related CB-M365-MAIL-027 Turn on Safe Documents for Office clients without click-through

People and lifecycle