Safe Attachments for SharePoint, OneDrive, and Microsoft Teams - Microsoft Defender for Office 365 (2024)

In organizations with Microsoft Defender for Office 365, Safe Attachments for SharePoint, OneDrive, and Microsoft Teams provides an additional layer of protection against malware. After files are asynchronously scanned by the common virus detection engine in Microsoft 365, Safe Attachments opens files in a virtual environment to see what happens (a process known as detonation). As part of detonation, any password protected files are checked against a list of known passwords or patterns that are typically used by malicious actors. Safe Attachments for SharePoint, OneDrive, and Microsoft Teams also helps detect and block existing files that are identified as malicious in team sites and document libraries.

Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is enabled by default. To turn it on or off, see Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

When Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is enabled and identifies a file as malicious, the file is locked using direct integration with the file stores. The following image shows an example of a malicious file detected in a library.

Although the blocked file is still listed in the document library and in web, mobile, or desktop applications, people can't open, copy, move, or share the file. But, they can delete the blocked file.

Here's an example of what a blocked file looks like on a mobile device:

By default, people can download a blocked file. Here's what downloading a blocked file looks like on a mobile device:

SharePoint Online admins can prevent people from downloading malicious files. For instructions, see Use SharePoint Online PowerShell to prevent users from downloading malicious files.

To learn more about the user experience when a file has been detected as malicious, see What to do when a malicious file is found in SharePoint Online, OneDrive, or Microsoft Teams.

Files that are identified as malicious by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams appear in reports for Microsoft Defender for Office 365 and in Explorer (and real-time detections).

When a file is identified as malicious by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, the file is also available in quarantine, but only to admins. For more information, see Manage quarantined files in Defender for Office 365.

Keep these points in mind

• Defender for Office 365 doesn't scan every single file in SharePoint Online, OneDrive for Business, or Microsoft Teams. This behavior is by design. Files are scanned asynchronously. The process uses sharing and guest activity events along with smart heuristics and threat signals to identify malicious files.

• Make sure your SharePoint sites are configured to use the Modern experience. Visual indicators that a file is blocked are available only in the Modern experience.

• Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is part of your organization's overall threat protection strategy, which includes anti-spam and anti-malware protection in Exchange Online Protection (EOP), as well as Safe Links and Safe Attachments protection in Microsoft Defender for Office 365.