Edit

Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

  • Article
  • 2 minutes to read

Tip

Did you know you can try the features in Microsoft 365 Defender for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft 365 Defender portal trials hub. Learn about who can sign up and trial terms here.

Applies to

Safe Attachments for SharePoint, OneDrive, and Microsoft Teams in Microsoft Defender for Office 365 provides an additional layer of protection for files that have already been scanned asynchronously by the common virus detection engine in Microsoft 365. Safe Attachments for SharePoint, OneDrive, and Microsoft Teams helps detect and block existing files that are identified as malicious in team sites and document libraries.

Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is not enabled by default. To turn it on, see Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams.

How Safe Attachments for SharePoint, OneDrive, and Microsoft Teams works

When Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is enabled and identifies a file as malicious, the file is locked using direct integration with the file stores. The following image shows an example of a malicious file detected in a library.

The files in OneDrive for Business with one detected as malicious

Although the blocked file is still listed in the document library and in web, mobile, or desktop applications, people can't open, copy, move, or share the file. But they can delete the blocked file.

Here's an example of what a blocked file looks like on a mobile device:

The option to delete a blocked file from OneDrive for Business from the OneDrive mobile app

By default, people can download a blocked file. Here's what downloading a blocked file looks like on a mobile device:

The option to download a blocked file in OneDrive for Business

SharePoint Online admins can prevent people from downloading malicious files. For instructions, see Use SharePoint Online PowerShell to prevent users from downloading malicious files.

To learn more about the user experience when a file has been detected as malicious, see What to do when a malicious file is found in SharePoint Online, OneDrive, or Microsoft Teams.

View information about malicious files detected by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

Files that are identified as malicious by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams will show up in reports for Microsoft Defender for Office 365 and in Explorer (and real-time detections).

When a file is identified as malicious by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, the file is also available in quarantine, but only to admins. For more information, see Manage quarantined files in Defender for Office 365.

Keep these points in mind

  • Defender for Office 365 will not scan every single file in SharePoint Online, OneDrive for Business, or Microsoft Teams. This is by design. Files are scanned asynchronously. The process uses sharing and guest activity events along with smart heuristics and threat signals to identify malicious files.

  • Make sure your SharePoint sites are configured to use the Modern experience. Defender for Office 365 protection applies whether the Modern experience or the Classic view is used; however, visual indicators that a file is blocked are available only in the Modern experience.

  • Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is part of your organization's overall threat protection strategy, which includes anti-spam and anti-malware protection in Exchange Online Protection (EOP), as well as Safe Links and Safe Attachments in Microsoft Defender for Office 365. To learn more, see Protect against threats in Office 365.