• Type: CUSTOMER
• Severity:  WARNING
• Protection against: MALWARE
• CIS: M365 2.4 - (L2) Ensure Office 365 ATP for SharePoint, OneDrive, and Microsoft Teams is Enabled
• FIX Available: YES

This Customer Check verifies if Microsoft 365 Defender for SharePoint, OneDrive, and Teams is enabled.

Why this check?

Microsoft Defender can scan files within SharePoint, OneDrive, and Teams for the presence of malware. Normally, malware is stopped on computers by antivirus software, but it is almost never certain that all computers of everyone connecting to your Microsoft Cloud are equipped with up-to-date antivirus software. Moreover, it also happens that malware is not recognized as malicious even by up-to-date antivirus software. Therefore, it makes sense to continue scanning in the central file storage.

CIS Benchmarks

This measure aligns with the following item from the Center for Internet Security (CIS) Microsoft 365 Foundations Benchmark: 

• CIS M365 2.4 - (L2) Ensure Office 365 ATP for SharePoint, OneDrive, and Microsoft Teams is Enabled

What are the possible outcomes of the check?

This check has two possible outcomes. In Attic, this is reflected as follows:

• Okay: Microsoft 365 Defender for SharePoint, OneDrive & Teams is enabled
• Warning: Microsoft 365 Defender for SharePoint, OneDrive & Teams is not yet enabled

How should this be followed up?

If the output is Warning , we advise enabling this feature. A Fix is available for this check, which we will offer via Attic.