Each domain has a Safe Attachments policy applied to it
ORCA.227MediumDefenderSafe Attachments
Part of ORCA · Defender · Safe Attachments · All checks
Invoke-Maester -TestId ORCA.227Overview
Section titled “Overview”Microsoft Defender for Office 365 Safe Attachments policies are applied using rules. The recipient domain condition is the most effective way of applying the Safe Attachments policy, ensuring no users are left without protection. If polices are applied using group membership make sure you cover all users through this method. Applying polices this way can be challenging, users may left unprotected if group memberships are not accurate and up to date. It is important not to rely on the ‘built-in’ Safe Links policy, as this policy only applies the minimum level of protections and should serve as a catch-all.
Remediation action
Section titled “Remediation action”Apply a Safe Attachments policy to every domain.
Related Links
Section titled “Related Links”- Microsoft 365 Defender Portal - Safe attachments
- Order and precedence of email protection
- Recommended settings for EOP and Microsoft Defender for Office 365
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | ORCA.227 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Attachments |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566.001 Spearphishing Attachment, T1204.002 Malicious File |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA227 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
Section titled “Source”- Test:
tests/orca/Test.ORCA.227.ps1 - Documentation:
tests/orca/Test.ORCA.227.md