AD2.3 Safe Attachments: Sandboxing Before Delivery

Creating the Safe Attachments policy

Navigate to security.microsoft.com → Email & collaboration → Policies & rules → Threat policies → Safe Attachments. Click "Create" to build a new policy.

Name: "Safe Attachments — All Users"

Users and domains: Include → All recipients.

Settings:

Safe Attachments unknown malware response: Select Dynamic Delivery. This is the recommended setting for most organizations. The email body arrives immediately — the user can read the message and see that an attachment exists. The attachment is held for sandbox scanning (typically 1-5 minutes) and then delivered if clean. If malicious, the attachment is blocked and the user receives a notification.

The other options exist for specific use cases. "Block" holds the entire email (body and attachment) until scanning completes — this is more secure but creates noticeable email delays. "Replace" delivers the email without the attachment and appends a notification — useful for environments where users should never receive unknown attachments. "Monitor" scans but doesn't block — useful during initial deployment to measure the impact without affecting email flow. For production deployment, Dynamic Delivery is the right choice: it minimizes user impact while providing full protection.

Redirect attachment on detection: Enable this and enter your admin email address (or a shared mailbox you monitor). When Safe Attachments blocks a malicious attachment, a copy is sent to this address for review. This gives you visibility into what's being blocked without needing to check the portal daily — the blocked attachments come to you.

Apply the above selection if scanning times out or errors occur: Enable this. If the sandbox scan fails or times out, the attachment is treated as if it were malicious (blocked). Better to delay a legitimate attachment than to deliver a potentially malicious one because the scanner had a hiccup.

Click "Submit" to create the policy.

What Dynamic Delivery looks like for users

When a user receives an email with an attachment while scanning is in progress, they see the email body normally. In place of the attachment, they see a placeholder: "Safe Attachments is scanning this attachment. It will be available shortly." If they're using Outlook desktop, the placeholder updates automatically when scanning completes — the attachment appears without the user needing to do anything.

If the user needs the attachment urgently and scanning hasn't completed, they wait. This is the one scenario where Safe Attachments creates user friction. The wait is typically 1-5 minutes for standard Office documents, and up to 10 minutes for complex files or password-protected archives. Communicate this to users during deployment: "Attachments may take a few extra minutes to appear. This is because they're being scanned for malware in a secure sandbox before delivery."

If scanning completes and the attachment is clean, it appears normally. If the attachment is malicious, it's removed and the user receives a notification: "An attachment in this email has been blocked because it was found to contain malicious content." The email body remains in the inbox — only the attachment is removed.

Monitoring Safe Attachments effectiveness

After deploying the policy, track its effectiveness through two channels.

The redirect mailbox. Every blocked attachment is sent to your redirect address. Check this mailbox weekly. Each blocked attachment tells you: what type of malware is targeting your organization (ransomware droppers, credential stealers, remote access trojans), which file formats attackers are using (Word macros, Excel 4.0 macros, PDF exploits, ISO/IMG container files), and which users are being targeted (is it random or focused on specific departments?). Over time, this data shapes your security awareness messaging — if 80% of blocked attachments are Word documents with macros, your user training should emphasise "never enable macros in unexpected documents."

The Defender reports. Navigate to security.microsoft.com → Reports → Email & collaboration → Threat protection status. Filter by "Detection type: Safe Attachments." This shows the volume of attachments scanned, the percentage blocked, and the file types involved. Track this monthly — a sudden spike in blocked attachments may indicate a targeted campaign.

You can also verify Safe Attachments is working via PowerShell by checking the transport rules and policy assignment:

Connect-ExchangeOnline
Get-SafeAttachmentPolicy | Select-Object Name, Action, Enable, Redirect, RedirectAddress | Format-List

This confirms your policy settings are active. The Action should show "DynamicDelivery" and Redirect should be "True" with your admin mailbox as the RedirectAddress. Run this check after any configuration change to verify the settings took effect.

Extending Safe Attachments to SharePoint, OneDrive, and Teams

Safe Attachments can also scan files uploaded to SharePoint Online, OneDrive for Business, and Microsoft Teams. This is a separate setting from the email policy. Navigate to security.microsoft.com → Policies & rules → Threat policies → Safe Attachments → Global settings.

Enable "Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams." This scans files when they're uploaded — if a user uploads a malicious file to a SharePoint document library or shares it via OneDrive, Safe Attachments blocks the file before other users can download it.

This is particularly important for shared document libraries where multiple users access the same files. A single malicious file uploaded by a compromised account (or received from an external collaborator via guest access) can spread to every user who opens the shared library. Safe Attachments for SharePoint/OneDrive/Teams prevents this lateral spread.