# Microsoft Teams protection policies are configured to block malicious messages, links, and attachments
Microsoft Teams is a common collaboration channel, so threat actors can use chats, channels, and meeting conversations for social engineering, malicious…
Source: https://maester.dev/docs/tests/ZTA.41114
## Overview
Microsoft Teams is a common collaboration channel, so threat actors can use chats, channels, and meeting conversations for social engineering, malicious URLs, and files shared through Teams-backed SharePoint or OneDrive storage. Microsoft Defender for Office 365 adds Teams protections beyond built-in warnings: Safe Links checks Teams URLs at time of click, Safe Attachments detonates files shared in Teams storage, ZAP for Teams quarantines malware and high confidence phishing messages after delivery, and the Defender submission policy can monitor user-reported Teams items. These controls reduce the chance that initial access through a chat becomes credential access, malware execution, lateral movement, or impact. If this check fails, one or more Teams delivery paths remains weak: a user might click a weaponized link after delivery, open a malicious file, miss a post-delivery quarantine action, or lack Defender monitoring for Teams reports. This check verifies configuration, not every user's license assignment or every Teams admin-center setting, so review exceptions and license coverage separately.
## Remediation
- [Microsoft Defender for Office 365 support for Microsoft Teams](https://learn.microsoft.com/en-us/defender-office-365/mdo-support-teams-about)
- [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-about)
- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)
- [User reported settings in Teams](https://learn.microsoft.com/en-us/defender-office-365/submissions-teams)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Email and collaboration security |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| ATT&CK | [T1566](/docs/tests?mitre=T1566) Phishing, [T1204.001](/docs/tests?mitre=T1204.001) Malicious Link, [T1204.002](/docs/tests?mitre=T1204.002) Malicious File |
| Licence | ATP_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.