Back to Checks
m365

ATP Safe Attachments policy has Safe Documents enabled and click-through blocked for SharePoint, OneDrive, and Microsoft Teams

defender_atp_safe_attachments_and_docs_configured
Service: defenderSeverity: medium
OfficialBuilt-inVerified
Categories:e5
Resource Type:NotDefined

Microsoft Defender for Office 365 Safe Attachments for SharePoint, OneDrive, and Microsoft Teams protects organizations from inadvertently sharing malicious files. When enabled, files identified as malicious are blocked and cannot be opened, copied, moved, or shared until further actions are taken by the organization's security team.

Prowler logoProwlerprowler-provider-m365

Risk

Without Safe Attachments enabled, users may download, sync, or access malicious files from SharePoint, OneDrive, or Teams, potentially leading to malware infections across the organization. If Safe Documents is disabled or users can bypass Protected View, malicious content in Office documents may execute and compromise endpoints.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks defender_atp_safe_attachments_and_docs_configured

Recommendation

Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams along with Safe Documents to protect users from malicious files. Block users from bypassing Protected View warnings for files identified as malicious to maintain defense-in-depth.

Remediation

CLI

Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true -EnableSafeDocs $true -AllowSafeDocsOpen $false

Other

1Navigate to Microsoft 365 Defender portal at https://security.microsoft.com.
2Go to **Email & Collaboration** > **Policies & Rules** > **Threat policies**.
3Under **Policies**, select **Safe Attachments**.
4Click on **Global settings**.
5Enable **Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams**.
6Enable **Turn on Safe Documents for Office clients**.
7Disable **Allow people to click through Protected View even if Safe Documents identified the file as malicious**.
8Click **Save**.

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.defender.defender_client import defender_client


class defender_atp_safe_attachments_and_docs_configured(Check):
    """
    Check if Safe Attachments for SharePoint, OneDrive, and Teams is properly configured.

    This check verifies that the ATP (Advanced Threat Protection) policy for Office 365 has:
    - EnableATPForSPOTeamsODB = True (Safe Attachments enabled for SPO/OneDrive/Teams)
    - EnableSafeDocs = True (Safe Documents enabled)
    - AllowSafeDocsOpen = False (Users cannot bypass Protected View for malicious files)

    - PASS: All three settings are properly configured.
    - FAIL: One or more settings are not properly configured.
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the check to verify Safe Attachments ATP policy configuration.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []

        if defender_client.advanced_threat_protection_policy:
            policy = defender_client.advanced_threat_protection_policy

            report = CheckReportM365(
                metadata=self.metadata(),
                resource=policy,
                resource_name=policy.identity,
                resource_id=policy.identity,
            )

            # Check all three required settings
            is_atp_enabled = policy.enable_atp_for_spo_teams_odb
            is_safe_docs_enabled = policy.enable_safe_docs
            is_safe_docs_open_blocked = not policy.allow_safe_docs_open

            if is_atp_enabled and is_safe_docs_enabled and is_safe_docs_open_blocked:
                # Case 1: ATP policy exists and is properly configured
                report.status = "PASS"
                report.status_extended = f"ATP policy {policy.identity} has Safe Attachments for SharePoint, OneDrive, and Teams properly configured with Safe Documents enabled and click-through blocked."
            else:
                # Case 2: ATP policy exists but is not properly configured
                report.status = "FAIL"
                issues = []
                if not is_atp_enabled:
                    issues.append("Safe Attachments for SPO/OneDrive/Teams is disabled")
                if not is_safe_docs_enabled:
                    issues.append("Safe Documents is disabled")
                if not is_safe_docs_open_blocked:
                    issues.append("users can bypass Protected View for malicious files")
                report.status_extended = f"ATP policy {policy.identity} is not properly configured: {'; '.join(issues)}."

            findings.append(report)

        return findings

References