8.4 Safe Attachments Policies

Safe Attachments Policies

By the end of this subsection, you will understand sandbox detonation modes, know when to use Dynamic Delivery vs Block, configure Safe Attachments for SharePoint/OneDrive/Teams, and verify detonation results with KQL.

How Safe Attachments works

Safe Attachments opens email attachments in an isolated sandbox (a virtual machine) and observes their behavior. If the file tries to execute code, modify the registry, download additional files, or phone home to a C2 server, it is classified as malicious and blocked.

This catches zero-day malware that signature-based scanning misses — the file has never been seen before, so it has no signature, but its behavior in the sandbox reveals malicious intent.

Detonation modes

Safe Attachments for SharePoint, OneDrive, and Teams

Email attachments are not the only file vector. Attackers upload malicious files to SharePoint or share them via Teams. Safe Attachments for SPO/OD/Teams scans files uploaded to these services and blocks access to files identified as malicious.

Configuration: In Threat policies, enable “Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams.” This is a global setting — it applies to all sites and channels.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

// Verify Safe Attachments detections
EmailAttachmentInfo
| where TimeGenerated > ago(30d)
| where ThreatTypes has "Malware"
| summarize
    MalwareCount = count(),
    UniqueFiles = dcount(SHA256),
    FileTypes = make_set(FileType, 10)
    by bin(TimeGenerated, 1d)
| sort by TimeGenerated asc

Safe Documents for Office clients

Safe Documents extends sandbox detonation to files opened in Protected View on desktop Office apps. When a user opens a Word, Excel, or PowerPoint file from the internet or an email attachment, Office opens it in Protected View (read-only). Safe Documents scans the file while it is in Protected View. If the file is clean, the user can click “Enable Editing.” If malicious, the file is blocked.

This catches a common attack vector: a user downloads a macro-enabled document from a website (not email), opens it in Word, and the macro detonation in Safe Documents catches the malware before the user enables editing.

Detonation verdict verification

After configuring Safe Attachments, verify it is working by checking detonation results:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

EmailAttachmentInfo
| where TimeGenerated > ago(7d)
| where ThreatTypes != ""
| summarize
    Detections = count(),
    UniqueHashes = dcount(SHA256),
    FileTypes = make_set(FileType),
    Actions = make_set(DeliveryAction)
    by ThreatTypes
| sort by Detections desc