General

The Safe Attachments policy helps protect users from malware in email attachments by scanning them for viruses, malware, and other malicious content. When an email attachment arrives, Safe Attachments will analyze it in a secure environment and decide whether it is safe or not.

Rationale

By enabling Safe Attachments policy, users are protected from malware threats in email attachments by analyzing suspicious attachments in a secure, cloud-based environment before they are delivered to the inbox. This provides an extra layer of protection and can prevent new or unknown types of malware from infiltrating the organization.

Attic Fix

No fix is available for this check. Follow the advice by executing the manual instructions.

Manual Instruction

Perform these steps to adjust the setting:

1. Go to Microsoft 365 Defender https://security.microsoft.com
2. Click Email & Collaboration open and select Policies & Rules
3. On the Policies & Rules page, select Threat Policies
4. Under Policies select Safe Attachments
5. Click + Create
6. Type a Policy Name and Description and click Next
7. Select all valid domains and click Next
8. Select Block
9. Quarantine Policy is AdminOnlyAccessPolicy
10. Leave Enable redirect disabled
11. Click Next and finally Submit

Impact

Delivery of emails with attachments may be delayed while scanning is performed.

CIS Mapping

• CIS Item: 4.5 (L2) Ensure Attachments policy is enabled
  
• Profile: E5 Level 2