{
  "id": "CB-M365-MAIL-026",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-026",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-026.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-026.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-026",
    "title": "Scan SharePoint, OneDrive and Teams files with Safe Attachments and block infected downloads",
    "finding": {
      "title": "Files stored in SharePoint, OneDrive and Teams are not scanned by Safe Attachments",
      "description": "Malicious files uploaded or shared in collaboration sites are not detected, and users can still download a file once it is flagged."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-office-365",
      "safe-attachments",
      "sharepoint",
      "onedrive",
      "teams"
    ],
    "applicability": {
      "requires": [
        "Microsoft Defender for Office 365 Plan 1"
      ]
    },
    "description": "Two settings are on:\n\n- **Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams** in the Safe\n  Attachments global settings (`EnableATPForSPOTeamsODB $true`);\n- SharePoint prevents users from downloading files that Defender detected as malicious\n  (`DisallowInfectedFileDownload $true`).\n",
    "rationale": "Collaboration storage is a common way to spread malware inside the organization and to partners:\na file shared from a trusted tenant does not go through email filtering. Scanning catches it, and\nblocking the download stops users from opening it anyway.\n",
    "impact": "Users cannot download, open in the desktop app, copy or sync files flagged as malicious; they can\nstill delete them. Administrators can release false positives from quarantine.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Safe\n   Attachments** > **Global settings** and check that **Turn on Defender for Office 365 for\n   SharePoint, OneDrive, and Microsoft Teams** is on.\n3. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-AtpPolicyForO365 | Format-List EnableATPForSPOTeamsODB\n   ```\n4. In SharePoint Online Management Shell (`Get-SPOTenant` requires the SharePoint Administrator\n   role; there is no read-only role for it):\n   ```powershell\n   Get-SPOTenant | Format-List DisallowInfectedFileDownload\n   ```\n5. Fail if either value is `False`.\n"
    },
    "remediation": {
      "manual": "1. In the Defender portal, **Safe Attachments** > **Global settings**, turn on **Turn on\n   Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams** and save. PowerShell\n   equivalent (Security Administrator):\n   ```powershell\n   Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true\n   ```\n2. In SharePoint Online Management Shell (SharePoint Administrator):\n   ```powershell\n   Set-SPOTenant -DisallowInfectedFileDownload $true\n   ```\n",
      "rollback": "`Set-SPOTenant -DisallowInfectedFileDownload $false`.\n"
    },
    "references": [
      {
        "title": "Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams",
        "url": "https://learn.microsoft.com/defender-office-365/safe-attachments-for-spo-odfb-teams-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-AtpPolicyForO365",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-atppolicyforo365",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft 365 security suite baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.1.4v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1204.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-025",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-027",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}