What this check looks at
Checks that Defender for Office 365 scans files in SharePoint, OneDrive and Teams, and, where licensed, that Safe Documents is on with no click-through for files it finds malicious.
Email filtering only sees files that arrive by email. Files uploaded to SharePoint, saved to OneDrive or shared in Teams are scanned by Defender for Office 365 only when its global setting for SharePoint, OneDrive and Microsoft Teams is on; a file it finds malicious is then locked so nobody can open, move or share it. Safe Documents, in Microsoft 365 E5 and E5 Security, goes further and checks Office files opened in Protected View before the user can leave it.
The check reads the Defender for Office 365 global settings. It fails when scanning in SharePoint, OneDrive and Teams is off. Where the licences include Safe Documents, it also fails when Safe Documents is off, or when people may click through Protected View even after Safe Documents finds the file malicious. It is not applicable without Defender for Office 365.
Once email is well protected, attackers share files instead: a malicious document posted in a Teams chat from a compromised partner tenant, or a file dropped into a shared OneDrive folder. With scanning off, the file sits in the library, syncs to every member’s laptop and is opened in trust because it came through a business tool.
Why it matters
Malware shared through Teams or OneDrive never passes through email filtering. Scanning those files, and opening downloaded Office files in Safe Documents first, closes the route most often used once email is protected.
A partner’s compromised account shares a project specification in a Teams channel the client uses for a joint project, and five people open it in the first hour. With Safe Attachments for Teams on, Microsoft detonates the file and locks it; with it off, the only defence left is the antivirus on each laptop.
The setting is included in Business Premium and E5 and changes nothing for users unless a file is malicious, when it is blocked. Leaving it off means paying for protection that does not cover the place most files now live.
CIS Microsoft 365 Foundations Benchmark 2.1.5 and CISA SCuBA MS.DEFENDER.3.1 ask for Safe Attachments for SharePoint, OneDrive and Teams. ISO 27001 A.8.7 (protection against malware), CIS Controls v8 9.7 and 10.1, NIST CSF 2.0 DE.CM-09 and NCSC CAF B4.b cover the same need, and the Cyber Essentials Plus malware protection test checks how files are handled.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Safe Attachments → Global settings
Before you start
- Needs Defender for Office 365 (Safe Documents also needs Microsoft 365 E5 or A5).
Step by step
- Check the licences. Scanning in SharePoint, OneDrive and Teams needs Defender for Office 365 Plan 1 or Plan 2 (Business Premium and E5 include it). Safe Documents needs Microsoft 365 E5, A5 or E5 Security, with Microsoft 365 Apps for enterprise on the devices. Check in the Microsoft 365 admin centre under Billing > Licences.
- Open the Safe Attachments global settings. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Safe Attachments and select Global settings.
- Turn on scanning for SharePoint, OneDrive and Teams. Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams. This one switch covers every site, every OneDrive and every team in the tenant.
- Turn on Safe Documents without click-through. Where licensed, turn on Safe Documents for Office clients, and leave off the option that lets people click through Protected View even if Safe Documents identified the file as malicious. Select Save.
- Or set both in PowerShell. Connect with Connect-ExchangeOnline and run Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true, adding -EnableSafeDocs $true -AllowSafeDocsOpen $false where Safe Documents is licensed.
- Stop people downloading infected files. Microsoft also recommends blocking downloads of files it has found malicious. In SharePoint Online Management Shell run Connect-SPOService -Url https://contoso-admin.sharepoint.com, then Set-SPOTenant -DisallowInfectedFileDownload $true. It is not part of this check but completes the protection.
- Confirm the settings. Run Get-AtpPolicyForO365 | Format-List EnableATPForSPOTeamsODB, EnableSafeDocs, AllowSafeDocsOpen and check the first is True and, where Safe Documents is licensed, EnableSafeDocs is True and AllowSafeDocsOpen False. The next assessment passes.
With PowerShell
Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true -EnableSafeDocs $true -AllowSafeDocsOpen $false
What users will notice
Files found to be malicious in SharePoint, OneDrive and Teams are locked so they cannot be opened or downloaded. Documents opened in Protected View are checked first.
How to confirm it worked
Get-AtpPolicyForO365 shows EnableATPForSPOTeamsODB True and, where licensed, EnableSafeDocs True with AllowSafeDocsOpen False.
Frameworks and controls
This check maps to controls in 17 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | ApplicationsData |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.2.1 An anti-malware solution is deployed on all system components |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malware |
| CISA SCuBA | MS.DEFENDER.3.1v1 Safe Attachments for SharePoint, OneDrive and Teams |
| CIS M365 | 2.1.5 Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is enabled |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3)10.1 Deploy and maintain anti-malware software (IG1) |
| NIST CSF 2.0 | DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Safe Attachments for SharePoint, OneDrive and Teams (Microsoft Learn)