Safe Attachments in Microsoft Defender for Office 365

Safe Attachments in Microsoft Defender for Office 365 provides an additional layer of protection for email attachments that have already been scanned by Anti-malware protection. Specifically, Safe Attachments uses a virtual environment to check attachments in email messages for harmful attachments (for example, malware, ransomware, and phishing) before they're delivered to recipients (a process known as detonation).

Safe Attachments protection for email messages is controlled by Safe Attachments policies. Although there's no default Safe Attachments policy, the Built-in protection preset security policy provides Safe Attachments protection to all recipients (users who aren't defined in the Standard or Strict preset security policies or in custom Safe Attachments policies). For more information, see Preset security policies. You can also create Safe Attachments policies that apply to specific users, group, or domains. For instructions, see Set up Safe Attachments policies in Microsoft Defender for Office 365.

The following table describes scenarios for Safe Attachments in Microsoft 365 and Office 365 organizations that include Microsoft Defender for Office 365 (in other words, lack of licensing is never an issue in the examples).

Safe Attachments scanning takes place in the same region where your Microsoft 365 data resides. For more information about datacenter geography, see Where is your data located?

Safe Attachments policy settings

This section describes the settings in Safe Attachments policies:

• Recipient filters: Conditions and exceptions to identify the internal recipients that the policy applies to. At least one condition is required. You can use the following recipient filters for conditions and exceptions:

  • Users: One or more mailboxes, or mail users in the organization.
  • Groups:
    • Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported).
    • The specified Microsoft 365 Groups (dynamic membership groups in Microsoft Entra ID aren't supported).
  • Domains: One or more of the configured accepted domains in Microsoft 365. The recipient's primary email address is in the specified domain.

  You can use a condition or exception only once, but the condition or exception can contain multiple values:

  • Multiple values of the same condition or exception use OR logic (for example, <recipient1> or <recipient2>):

    • Conditions: If the recipient matches any of the specified values, the policy is applied to them.
    • Exceptions: If the recipient matches any of the specified values, the policy isn't applied to them.

  • Different types of exceptions use OR logic (for example, <recipient1> or <member of group1> or <member of domain1>). If the recipient matches any of the specified exception values, the policy isn't applied to them.

  • Different types of conditions use AND logic. The recipient must match all of the specified conditions for the policy to apply to them. For example, you configure a condition with the following values:

  • Users: romain@contoso.com

  • Groups: Executives

    The policy is applied to romain@contoso.com only if he's also a member of the Executives group. Otherwise, the policy isn't applied to him.

• Safe Attachments unknown malware response: This setting controls the action for Safe Attachments threat scanning in email messages. The available options are described in the following table:

  Option	Effect	Use when you want to:
  Off	Attachments aren't scanned for threats by Safe Attachments (for example, malware, ransomware, and phishing). Messages are still scanned for malware by Anti-malware protection.	Turn scanning off for selected recipients. Prevent unnecessary delays in routing internal mail. This option is not recommended for most users. You should only use this option to turn off Safe Attachments scanning for recipients who only receive messages from trusted senders. ZAP doesn't quarantine messages if Safe Attachments is turned off and a threat signal isn't received. For details, see Zero-hour auto purge
  Monitor	Delivers messages with attachments and then tracks what happens with detected threats. Delivery of safe messages might be delayed due to Safe Attachments scanning.	See where detected messages go in your organization.
  Block	Prevents messages with detected attachments from being delivered. Messages are quarantined. By default, only admins (not users) can review, release, or delete the messages.¹ Automatically blocks future instances of the messages and attachments. Delivery of safe messages might be delayed due to Safe Attachments scanning.	Protects your organization from repeated attacks using the same attachments. This value is the default, and the recommended value in Standard and Strict preset security policies.
  Dynamic Delivery	Delivers messages immediately, but replaces attachments with placeholders until Safe Attachments scanning is complete. Messages that contain malicious attachments are quarantined. By default, only admins (not users) can review, release, or delete the messages.¹ For details, see the Dynamic Delivery in Safe Attachments policies section later in this article.	Avoid message delays while protecting recipients from malicious files.

  ¹ Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see Anatomy of a quarantine policy. Users can't release their own messages quarantined as malware or phishing by Safe Attachments, regardless of how the quarantine policy is configured. If the policy is configured for users to release these quarantined messages, users are instead allowed to request the release of these quarantined messages.

• Redirect messages with detected attachments: Enable redirect and Send messages that contain monitored attachments to the specified email address: For the Monitor action only, send messages that contain detected attachments to the specified internal or external email address for analysis and investigation.

  The recommendation for Standard and Strict policy settings is to enable redirection. For more information, see Safe Attachments settings.

• Block messages containing encrypted attachments that could not be scanned: When you select Block as the Safe Attachments unknown malware response, you can turn on this setting to quarantine messages that contain encrypted (password-protected) attachments. This setting applies when Safe Attachments can't scan or detonate the attachments, for example, when the password isn't available. Affected messages are held in quarantine instead of being delivered until an admin or the recipient releases them. For more information, see the Encrypted (password-protected) attachments in Safe Attachments policies section later in this article.

• Priority: If you create multiple policies, you can specify the order that they're applied. No two policies can have the same priority, and policy processing stops after the first policy is applied (the highest priority policy for that recipient).

  For more information about the order of precedence and how multiple policies are evaluated and applied, see Order and precedence of email protection.

Dynamic Delivery in Safe Attachments policies

The Dynamic Delivery action in Safe Attachments policies seeks to eliminate any email delivery delays that might be caused by Safe Attachments scanning. The body of the email message is delivered to the recipient with a placeholder for each attachment. The placeholder remains until the attachment is found to be safe, and then the attachment becomes available to open or download.

If an attachment is found to be malicious, the message is quarantined.

Most PDFs and Office documents can be previewed in safe mode while Safe Attachments scanning is underway. If an attachment is not compatible with the Dynamic Delivery previewer, the recipients see a placeholder for the attachment until Safe Attachments scanning is complete.

If you're using a mobile device, and PDFs aren't rendering in the Dynamic Delivery previewer on your mobile device, try opening the message in Outlook on the web (formerly known as Outlook Web App) using your mobile browser.

Here are some considerations for Dynamic Delivery and forwarded messages:

• If the forwarded recipient is protected by a Safe Attachments policy that uses the Dynamic Delivery option, then the recipient sees the placeholder, with the ability to preview compatible files.
• If the forwarded recipient is not protected by a Safe Attachments policy, the message and attachments are delivered without any Safe Attachments scanning or attachment placeholders.

There are scenarios where Dynamic Delivery is unable to replace attachments in messages. These scenarios include:

• Messages in public folders.
• Messages that are routed out of and then back into a user's mailbox using custom rules.
• Messages that are moved (automatically or manually) out of cloud mailboxes to other locations, including archive folders.
• Inbox rules move the message out of the Inbox into a different folder.
• Deleted messages.
• The user's mailbox search folder is in an error state.
• Exchange Online organizations where Exclaimer is enabled. To resolve this issue, see KB4014438.
• S/MIME) encrypted messages.
• You configured the Dynamic Delivery action in a Safe Attachments policy, but the recipient doesn't support Dynamic Delivery (for example, the recipient is a mailbox in an on-premises Exchange organization). However, Safe Links in Microsoft Defender for Office 365 is able to scan Office file attachments that contain URLs (if Safe Links scanning of support Office apps is turned on in the applicable Safe Links policy).

Encrypted (password-protected) attachments in Safe Attachments policies

Encrypted (password-protected) attachments are common in business workflows, but they create inspection challenges. Safe Attachments opens email attachments in a virtual environment to check them for malicious content (a process known as detonation). Safe Attachments can't fully scan or detonate a password-protected attachment unless the password is available (for example, extracted from the email body during scanning).

You configure Safe Attachments policies to quarantine messages that contain password-protected attachments when scanning or detonation can't complete. Affected messages are quarantined instead of delivered. They stay in quarantine until they're released:

• Admins can release the message at any time with full authority, without needing the password. For instructions, see Manage quarantined messages and files as an admin in Microsoft Defender for Office 365.
• Users can self-release their own quarantined message by supplying the password for the attachment, if the assigned quarantine policy allows users to release their own messages. Users can't release these messages directly from a quarantine notification email. Instead, they select Review message in the notification to open the message in the Microsoft Defender portal, select Release email, and then enter the attachment password. For instructions, see Find and release quarantined messages as a user in Microsoft Defender for Office 365.

On the Quarantine page in the Defender portal, these messages have the Password protected item quarantine reason value.

When a user supplies the password, Safe Attachments runs a just-in-time detonation (a new scan) of the attachment before release. The password is used only to open and rescan the attachment. It isn't stored.

• If the attachment is found to be safe, the message is released to the mailbox.
• If the attachment is found to be malicious or still can't be scanned, the message stays in quarantine for an admin to review.

Currently, the password can be submitted only once for each quarantined message. Retrying with another password isn't supported.

By default, this setting evaluates password-protected attachments of all file types. In the Exclude these attachment types section, you can exclude specific attachment types from the setting:

• Acrobat (pdf)
• Archive (zip, gzip, 7z, rar, tar only)
• Office (doc, docx, xls, xlsx, ppt, pptx only)
• All other file types

Attachments are identified by their true file type, not only by the file name extension.

A Quarantine policy value determines what recipients can do with these quarantined messages and whether they receive quarantine notifications. By default, the quarantine policy named DefaultFullAccessWithNotificationPolicy is used. For more information, see Anatomy of a quarantine policy.

This setting supports messages where a single password unlocks the attachments:

• A message with one password-protected attachment.
• A message with multiple password-protected attachments that all use the same password. The user enters the password once to evaluate and possibly release the message.

Messages that contain multiple password-protected attachments with different passwords aren't handled by this setting. The same limitation applies to a single archive (for example, a ZIP file) that contains multiple items protected by different passwords. These messages continue to be processed as they are today, without the quarantine and self-release experience.

In Defender for Office 365 Plan 2, security operations teams can identify messages with password-protected attachments by using advanced hunting:

EmailAttachmentInfo
| where AdditionalFields contains "IsPasswordProtectedItem"

Submit files for analysis

• If you receive a file that you want to send to Microsoft for analysis, see Submit malware and non-malware to Microsoft for analysis.
• If you receive an email message (with or without an attachment) that you want to submit to Microsoft for analysis, see Report messages and files to Microsoft.