What this check looks at
Checks the default anti-malware policy blocks at least 120 file types and at least 90% of the comprehensive list CIS supplies (184 types).
The common attachments filter in an anti-malware policy blocks attachments by file type, whatever their content, checking the true file type where it can and the extension otherwise. Microsoft’s default list is short, around 50 types, mostly executables and scripts, and in some older tenants the filter is off altogether.
The check reads the default anti-malware policy. It fails when the common attachments filter is off, and when fewer than 120 file types are blocked or fewer than 90% of the 184 types on the comprehensive list CIS supplies are included; it passes at 120 or more types covering at least 90% of that list. The evidence shows how many types are blocked and up to 60 of the CIS types that are missing.
Attackers move to whatever is not blocked: disk images (.iso, .img, .vhd), shortcuts (.lnk, .url), HTML and SVG files that build a phishing page or a download inside the browser, legacy macro documents and compressed archives (.7z, .rar). Each wave of malware delivery in recent years has leaned on a file type the default list did not cover.
Why it matters
Microsoft’s default list blocks the obvious executables. Attackers move to the next file type along: disk images, shortcuts, scripts and macro documents. A comprehensive list removes those options too.
A typical recent campaign: an email with an .svg voice message attachment that opens a convincing Microsoft sign-in page in the browser, or an .html remittance advice that assembles a malicious download locally, so no link is ever scanned. Blocking those types by name removes the route entirely, at no cost for the many organisations that never receive them legitimately.
The CIS list includes legacy Office formats (.doc, .xls, .ppt), .rtf, .ics, .eml and common archives, which some businesses do receive. That is the real cost of the change and the reason for a short conversation first: a supplier who still sends .xls price lists, or staff who forward suspicious emails to IT as .eml attachments, need another route before the filter goes live.
CIS Microsoft 365 Foundations Benchmark 2.1.11 asks for comprehensive attachment filtering and CIS Controls v8 9.6 for unnecessary file types to be blocked. ISO 27001 A.8.7, NIST CSF 2.0 PR.PS-01 and NCSC CAF B4.b cover malware protection, and the Cyber Essentials Plus malware protection test checks what happens when test files arrive by email.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-malware
Before you start
- Check whether any business process emails file types on the CIS list (for example .iso or .msi from a supplier) and agree another route for them.
Step by step
- Agree the business exceptions. Show the client the types on the CIS list they might receive legitimately: legacy Office files (.doc, .xls, .ppt, .pub), .rtf, .ics calendar files from external systems, .eml attachments (forwarded emails) and archives (.7z, .rar, .gz, .tar). Agree another route for anything they truly need, such as a shared OneDrive folder for a supplier who sends archives.
- Get the list of types to add. The finding’s evidence lists up to 60 of the CIS types missing from the policy; the full list is in recommendation 2.1.11 of the CIS Microsoft 365 Foundations Benchmark. In Exchange Online PowerShell, (Get-MalwareFilterPolicy -Identity Default).FileTypes shows what is blocked today.
- Add the types in PowerShell. Adding well over a hundred types one by one in the portal is slow, so use PowerShell: $current = (Get-MalwareFilterPolicy -Identity Default).FileTypes, then $add = @("7z","ace","ani", …) with the types you agreed, then Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true -FileTypes (($current + $add) | Sort-Object -Unique). FileTypes replaces the whole list, which is why the current types are included.
- Choose what happens to blocked messages. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-malware, select Default (Default) and Edit protection settings. Check Enable the common attachments filter is ticked and choose the action: quarantining the message lets an administrator release a genuine file, rejecting it with a non-delivery receipt tells the sender. Select Save.
- Apply the list to custom policies too. Custom anti-malware policies take priority over the default for the people they cover. Run the same Set-MalwareFilterPolicy command against each one so nobody is left on the short list.
- Confirm the policy. Run Get-MalwareFilterPolicy -Identity Default | Format-List EnableFileFilter, FileTypeAction and (Get-MalwareFilterPolicy -Identity Default).FileTypes.Count, and check the filter is True with at least 120 types. The next assessment passes when at least 90% of the CIS list is covered.
What users will notice
Messages with one of the listed attachment types are quarantined and the recipient is told.
How to confirm it worked
Get-MalwareFilterPolicy -Identity Default shows EnableFileFilter True and a FileTypes list of at least 120 types.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.2.1 An anti-malware solution is deployed on all system components |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malware |
| CIS M365 | 2.1.11 Ensure comprehensive attachment filtering is applied |
| CIS Controls v8.1 | 9.6 Block unnecessary file types (IG2) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Common attachments filter (Microsoft Learn)