Introduction

Email attachments are a primary way attackers can get malware delivered to users in organizations across the globe. Recipients often unwittingly open attachments that contain software threats that can take over their PC or even infect systems across their company or home network. Microsoft’s “Safe Attachments” feature helps defend against these threats by intensively examining the contents of attachment files and testing them before you ever open them. Everyone should maintain keen awareness of email attachment threats, but this added feature in Microsoft 365 is an extra layer of protection.

How do Safe Attachments work?

When a message contains one or more attachments, the message will be delivered, and Microsoft’s scanning engine will begin scanning the attachments for threats. You can read the message body immediately, but the attachments won't be completely available until the scan is complete. You may, however, preview attachments deemed "safe" before scanning is complete.

If you open a message immediately after it appears in your Inbox, you might see the attachments listed as being scanned, as shown here. Opening the "ATP Scan In Progress" attachment shows a message that explains the attachment sent to you is still being scanned. Scans are usually completed in under 2 minutes but could take longer for large attachments.

Open

What if an attachment is deemed unsafe?

Under the Safe Attachments feature, the email attachment is opened and tested in a virtual environment before you receive it. If the attachment is determined to be malicious, you will see the attachment listed as unsafe, as shown here.

Open

If the attachment is safe, it will open as expected when you click on it.

After clicking on a blocked attachment, you will see more details:

Open

Page Contents

Related Articles

Related Links

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-policies-configure?view=o365-worldwide