Turn on Safe Documents for Office clients without click-through

Description

In the Safe Attachments global settings:

• Turn on Safe Documents for Office clients is on (EnableSafeDocs $true);
• Allow people to click through Protected View even if Safe Documents identified the file as malicious is off (AllowSafeDocsOpen $false).

Office files opened in Protected View are sent to the Microsoft Defender for Endpoint cloud for analysis before users can leave Protected View.

Rationale

Files downloaded from the internet or received from outside open in Protected View, and leaving it is the moment a malicious macro or exploit runs. Safe Documents checks the file at that moment; without click-through, a file found to be malicious cannot be opened at all.

Impact

Users wait a short time before they can enable editing. Files flagged as malicious stay in Protected View. File information is sent to the Defender for Endpoint cloud and kept for less than 24 hours.

Applies when

Requires: Microsoft 365 E5 or Microsoft Defender Suite (Office 365 SafeDocs service plan)

Safe Documents is controlled by the Office 365 SafeDocs service plan, included in Microsoft 365 E5, A5 and G5 and in Microsoft Defender Suite, not in Defender for Office 365 Plan 1 or 2. Users need Microsoft 365 Apps for enterprise version 2004 or later.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Safe Attachments > Global settings.
3. Check that Turn on Safe Documents for Office clients is on and Allow people to click through Protected View even if Safe Documents identified the file as malicious is off.
4. In Exchange Online PowerShell (read-only):

   Get-AtpPolicyForO365 | Format-List EnableSafeDocs, AllowSafeDocsOpen
   

5. Fail if EnableSafeDocs is False or AllowSafeDocsOpen is True.

Remediation

1. In the Defender portal, Safe Attachments > Global settings, turn on Turn on Safe Documents for Office clients, turn off the click-through option, and save.
2. PowerShell equivalent (Security Administrator):

   Set-AtpPolicyForO365 -EnableSafeDocs $true -AllowSafeDocsOpen $false
   

Rollback

Set-AtpPolicyForO365 -AllowSafeDocsOpen $true, or -EnableSafeDocs $false.

References

• Safe Documents in Microsoft 365 A5/E5/G5 or Microsoft Defender Suite Microsoft, vendor-doc, accessed 2026-10-24
• Set-AtpPolicyForO365 Microsoft, vendor-doc, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-225, ORCA-234) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-026 Scan SharePoint, OneDrive and Teams files with Safe Attachments and block infected downloads

People and lifecycle