What this check looks at
Checks the default anti-malware policy’s common attachments filter, which blocks file types such as .exe, .js and .iso however clean they look.
Every Exchange Online anti-malware policy has a common attachments filter: a list of several dozen file types, including .exe, .js, .vbs, .iso, .bat, .cmd, .scr and .jar, that are blocked whatever their content. Messages carrying them are quarantined or rejected before anyone can open them. New default policies have it on, but older tenants and edited policies may not.
This check reads the default anti-malware policy in Exchange Online. The check fails when the common attachments filter is off.
New malware is not recognised by signatures until someone has seen it. Executables, scripts, disk images and installers are how much of it arrives by email, often zipped or renamed. Blocking those types on the file type alone stops them whether or not the scanner knows the payload, and almost no business needs to receive them by email.
Why it matters
Malware arrives as executables, scripts and disk images long before antivirus recognises it. Blocking the file types nobody needs by email stops new malware on the type alone, without waiting for a signature.
An office worker at a 20-person firm receives an email from a supposed courier with a .iso attachment containing a shortcut that launches a loader. It is too new for the antivirus signature; the user opens it and the loader deploys ransomware that encrypts the shared drive. With the filter on, the .iso never reaches the inbox.
Turning the filter on is one setting. The rare business that needs to receive one of the file types by email can agree another route, such as a SharePoint upload link.
CIS Microsoft 365 Foundations Benchmark 2.1.2 asks for the common attachment types filter to be enabled. CIS Controls v8 safeguards 9.6 (block unnecessary file types) and 9.7 (email server anti-malware protections), ISO 27001 A.8.7 (protection against malware), the NCSC CAF secure configuration outcome and NIST CSF DE.CM-09 support it.
How to fix it
Where: Microsoft Defender portal → Policies → Anti-malware
Before you start
- Check whether any business process emails file types on the list (for example .iso or .exe from a supplier) and agree another route for them.
Step by step
- Check business processes. Ask the client whether anyone routinely receives executables, scripts or disk images by email (for example installers from a supplier) and agree another route for those before blocking.
- Open the default anti-malware policy. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-malware and open Default (Default).
- Turn on the common attachments filter. Select Edit protection settings, tick Enable the common attachments filter, keep the default file types (adding any others you never expect by email), choose to quarantine the message, and make sure zero-hour auto purge for malware is on. Save.
- Or set it with PowerShell. In Exchange Online PowerShell run Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true -ZapEnabled $true.
- Check other anti-malware policies. If the tenant has custom anti-malware policies, or uses the Standard or Strict preset security policies, check they also have the filter on, because they apply to their users in place of the default.
- Confirm the filter is on. Run Get-MalwareFilterPolicy -Identity Default | Format-List EnableFileFilter, FileTypes and check EnableFileFilter is True. Over the following days, quarantine (Email & collaboration > Review > Quarantine) should show messages held for blocked file types. The finding clears at the next assessment.
With PowerShell
Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true
What users will notice
Messages with blocked attachment types are quarantined and the recipient is told.
How to confirm it worked
Get-MalwareFilterPolicy -Identity Default shows EnableFileFilter as True.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.2.1 An anti-malware solution is deployed on all system components |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malware |
| CIS M365 | 2.1.2 Ensure the Common Attachment Types Filter is enabled |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3)9.6 Block unnecessary file types (IG2) |
| NIST CSF 2.0 | DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Anti-malware policies (Microsoft Learn)