Configure and manage Safe Attachments

Safe Attachments is a feature in Microsoft 365 that helps protect your organization against malicious email attachments. It provides an additional layer of defense by automatically scanning and analyzing attachments for potential threats before delivering them to recipients. In this article, we will explore how to configure and manage Safe Attachments to enhance your organization’s security.

Enabling Safe Attachments

To enable Safe Attachments, you need to have the necessary administrative rights in the Microsoft 365 Security & Compliance Center. Here’s how you can enable it:

1. Sign in to the Microsoft 365 Security & Compliance Center (https://protection.office.com) with your administrative account.
2. Navigate to the Threat management > Safe attachments page.
3. Click on the “Settings” tab to access the Safe Attachments settings.
4. Toggle the switch to enable Safe Attachments for your organization.

Configuring Safe Attachments Policies

Safe Attachments uses policies to define how attachments should be handled. You can configure these policies based on your organization’s security requirements. Follow these steps to create or modify Safe Attachments policies:

1. On the Safe attachments page, click on “Create a policy.”
2. Enter a policy name and description to help you identify it.
3. Configure the policy settings for the default action, delivery behavior, and notification options based on your organization’s requirements.
• Default action: Choose whether attachments should be delivered or blocked if they can’t be scanned within a specified timeout period.
• Delivery behavior: Decide how to handle messages with attachments that couldn’t be scanned, including blocking, delivering, or sending them to a specified location for further analysis.
• Notification options: Specify whether notifications should be sent to recipients and/or admins when an attachment is being analyzed or blocked.
4. Save the policy when you have finished configuring the settings.

Applying Safe Attachments Policies

After creating the Safe Attachments policy, you need to apply it to the desired recipients. You can apply policies at different levels, such as organization-wide, specific user or group, or custom scopes. Here’s how to apply Safe Attachments policies:

1. On the Safe attachments page, go to the “Settings” tab.
2. Under the “Apply this policy to” section, choose the desired scope (organization-wide, specific user/group, or custom scope).
3. Select the appropriate policy from the drop-down list.
4. Save the changes.

Managing Safe Attachments

Once Safe Attachments is enabled and policies are configured, you can manage the service to meet your organization’s security needs. Here are some common management tasks:

1. Monitoring: You can monitor the effectiveness of Safe Attachments by reviewing the reports available in the Security & Compliance Center. These reports provide insights into the number of attachments scanned, blocked, and delivered. They also display details of any malware detected.
2. Quarantine: Safe Attachments automatically places attachments that couldn’t be processed within the defined timeout period into quarantine. You can review and release these attachments from the quarantine if necessary.
3. Alert policies: You can create alert policies to be notified when certain conditions related to Safe Attachments are met. For example, you can set up an alert to notify you whenever a high number of attachments are being blocked.
4. Troubleshooting: If you encounter any issues with Safe Attachments, you can check the status of the service in the Security & Compliance Center and leverage the available troubleshooting guides and resources.

Conclusion

Configuring and managing Safe Attachments in Microsoft 365 Messaging is an essential part of maintaining a secure email environment. By enabling this feature and properly configuring policies, you can add an extra layer of protection against malicious attachments. Regular monitoring and management will help ensure a proactive approach to safeguarding your organization’s data and users from potential threats.