Microsoft Teams protection policies are configured to block malicious messages, links, and attachments

Overview

Microsoft Teams is a common collaboration channel, so threat actors can use chats, channels, and meeting conversations for social engineering, malicious URLs, and files shared through Teams-backed SharePoint or OneDrive storage. Microsoft Defender for Office 365 adds Teams protections beyond built-in warnings: Safe Links checks Teams URLs at time of click, Safe Attachments detonates files shared in Teams storage, ZAP for Teams quarantines malware and high confidence phishing messages after delivery, and the Defender submission policy can monitor user-reported Teams items. These controls reduce the chance that initial access through a chat becomes credential access, malware execution, lateral movement, or impact. If this check fails, one or more Teams delivery paths remains weak: a user might click a weaponized link after delivery, open a malicious file, miss a post-delivery quarantine action, or lack Defender monitoring for Teams reports. This check verifies configuration, not every user’s license assignment or every Teams admin-center setting, so review exceptions and license coverage separately.

Remediation

• Microsoft Defender for Office 365 support for Microsoft Teams
• Safe Attachments for SharePoint, OneDrive, and Microsoft Teams
• Safe Links in Microsoft Defender for Office 365
• User reported settings in Teams

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Email and collaboration security
Product	Defender
Feature	Safe Links
Area	Email and collaboration protection
ATT&CK	T1566 Phishing, T1204.001 Malicious Link, T1204.002 Malicious File
Licence	ATP_ENTERPRISE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.