(L2) Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled

Contributed by Ben MilesAll contributors →

Part of CIS · Defender · Safe Attachments · All checks

Run this check

Invoke-Maester -TestId CIS.M365.2.1.5

Overview

2.1.5 (L2) Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled

Safe Attachments for SharePoint, OneDrive, and Microsoft Teams scans these services for malicious files.

Rationale

Safe Attachments for SharePoint, OneDrive, and Microsoft Teams protect organizations from inadvertently sharing malicious files. When a malicious file is detected that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization’s security team.

Impact

Impact associated with Safe Attachments is minimal, and equivalent to impact associated with anti-virus scanners in an environment.

Remediation action

To enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams:

1. Navigate to Microsoft 365 Defender https://security.microsoft.com
2. Under Email & collaboration select Policies & rules
3. Select Threat policies then Safe Attachments
4. Click on Global settings
5. Click to Enable Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams
6. Click to Enable Turn on Safe Documents for Office clients
7. Click to Disable Allow people to click through Protected View even if Safe Documents identified the file as malicious
8. Click Save.

PowerShell

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Run the following PowerShell command:

Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true -EnableSafeDocs $true -AllowSafeDocsOpen $false

Related links

• Microsoft 365 Defender
• Safe Attachments for SharePoint, OneDrive, and Microsoft Teams
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 96

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.2.1.5
Severity	Medium
Suite	CIS
Product	Defender
Related products	SharePoint, Teams
Feature	Safe Attachments
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1080 Taint Shared Content, T1204.002 Malicious File
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.5
Benchmark level	L2
Benchmark profiles	E5 Level 2
Supports controls	cis-m365:2.1.5, nist-800-53-r5:SI-3
PowerShell test	Test-MtCisSafeAttachmentsAtpPolicy
Services	ExchangeOnline, Graph
Compatible licenses	ATP_ENTERPRISE

Source

• Test: tests/cis/Test.CIS.M365.2.1.5.ps1
• Documentation: tests/cis/Test.CIS.M365.2.1.5.md