What this check looks at
Checks for a turned-on Safe Attachments policy that applies to everyone, blocks malicious attachments and quarantines them for administrators only.
Safe Attachments, part of Defender for Office 365, opens each email attachment in a sandbox before delivery and watches what it does, catching new malware that signature scanning has not seen before. Its policy sets the response (Off, Monitor, Block or Dynamic Delivery), and a quarantine policy decides whether people can release what it catches. The Built-in protection policy gives basic cover, but a policy you control is needed for the settings below.
The check looks for a Safe Attachments policy that is on, applies to everyone (no user or group conditions, every custom domain included), uses the Block response and quarantines with AdminOnlyAccessPolicy so only administrators can release. It fails when no policy is on, when none applies to everyone, or when the policy for everyone is off, uses another response (Monitor or Dynamic Delivery included) or lets users release. It is not applicable without Defender for Office 365.
Ransomware and information stealers usually arrive as an attachment: an invoice in a password-protected archive, a disk image, an HTML file, a document with a macro. Signature scanning misses anything new for its first hours. Monitor mode records the detonation and delivers anyway, and a quarantine policy that lets people release their own messages invites the curious to release the one marked malicious.
Why it matters
New malware is not yet known to antivirus. Safe Attachments opens attachments in a sandbox before delivery and blocks the ones that behave badly, catching what signature scanning misses.
Picture a 50-person engineering firm whose purchase ledger clerk opens a statement of account attachment from a supplier whose mailbox has been compromised. It is a new loader no signature recognises. Without sandboxing it runs, and within days the file server and its backups are encrypted. Recovery means a week or more of downtime and specialist help, usually tens of thousands of pounds for a firm that size.
Safe Attachments is included in Business Premium and E5, so the only costs are a few minutes’ delay on messages with attachments and an administrator reviewing quarantine now and then.
CIS Microsoft 365 Foundations Benchmark 2.1.4 asks for a Safe Attachments policy to be enabled. ISO 27001 A.8.7 (protection against malware), CIS Controls v8 9.7, NIST CSF 2.0 DE.CM-09 and NCSC CAF B4.b call for it, and the Cyber Essentials Plus malware protection test checks what happens when test files arrive by email.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Safe Attachments
Before you start
- Needs Defender for Office 365 Plan 1 or higher. Tell users attachments may take a few minutes longer to arrive.
Step by step
- Review the existing policies. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Safe Attachments. Note each policy, who it applies to and its response. If one already applies to everyone, correct it (see the PowerShell step) rather than adding another.
- Create the policy for everyone. Select Create and name it Safe Attachments - everyone. On Users and domains, under Domains add every accepted domain and leave Users and Groups empty. Add no exclusions without a documented reason.
- Set the response and the quarantine policy. On Settings, set Safe Attachments unknown malware response to Block, choose AdminOnlyAccessPolicy as the quarantine policy, and tick the option to apply the detection response if scanning cannot complete. Select Next, review and Submit, then use Increase priority until the policy is priority 0.
- Or set it in Exchange Online PowerShell. Run New-SafeAttachmentPolicy -Name "Safe Attachments - everyone" -Enable $true -Action Block -QuarantineTag AdminOnlyAccessPolicy, then New-SafeAttachmentRule -Name "Safe Attachments - everyone" -SafeAttachmentPolicy "Safe Attachments - everyone" -RecipientDomainIs (Get-AcceptedDomain).Name -Priority 0. To correct an existing policy, run Set-SafeAttachmentPolicy -Identity "<name>" -Enable $true -Action Block -QuarantineTag AdminOnlyAccessPolicy.
- Plan for quarantine reviews. Messages caught by Safe Attachments go to Email & collaboration > Review > Quarantine, where only administrators can release them. Agree who looks there when someone reports a missing message, and tell users that attachments may take a few minutes longer to arrive.
- Confirm the policy. Run Get-SafeAttachmentPolicy | Format-Table Name, Enable, Action, QuarantineTag and Get-SafeAttachmentRule | Format-Table Name, State, Priority, RecipientDomainIs. The policy for everyone should show True, Block and AdminOnlyAccessPolicy, enabled for every accepted domain. The next assessment passes.
What users will notice
Attachments are opened in a sandbox before delivery; malicious ones are quarantined where only admins can release them.
How to confirm it worked
Get-SafeAttachmentPolicy shows Enable True, Action Block and QuarantineTag AdminOnlyAccessPolicy; Get-SafeAttachmentRule shows it enabled for every accepted domain.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.2.1 An anti-malware solution is deployed on all system components |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malware |
| CIS M365 | 2.1.4 Ensure Safe Attachments policy is enabled |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3) |
| NIST CSF 2.0 | DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set up Safe Attachments policies (Microsoft Learn)