Application Permissions - Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled

 

Summary

Safe attachments for SharePoint, OneDrive, and Microsoft Teams scans these services for malicious files.

Reason

The safe attachments stated above, protects your organization from inadvertently sharing malicious files. Whenever a malicious file is detected, it will be blocked so that no one can open, copy, move, or share it, until further actions are take by the organization's security team.

What If?

The impact of this one is minimal and equivalent to the impact associated with anti-virus scanners in an environment.

How to?

To enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams use the Microsoft 365 Admin Center:

1. Under Admin centers click Security, in order to open the Microsoft 365 Defender.
2. Under Email & collaboration select Policies & rules.
3. Now, click on Global Settings.
4. Click the toggle to Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams.
5. Select Save.

To enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, use the Exchange Online PowerShell Module:

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Now, run the following command:

Set -AtpPolicyFor0365 -EnableATPForSPOTeamsODB $True

Monitor:

To verify that Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is enabled, use the Microsoft 365 Admin Center:

1. Under Admin centers click Security, in order to open the Microsoft 365 Defender.
2. Under Email & collaboration select Policies & rules.
3. Now, select Threat policies then Safe Attachments.
4. Click on Global settings.
5. Verify that toggle is selected to Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams.

To verify that Safe Attachments is enabled for SharePoint, OneDrive, and Microsoft Teams, use the Exchange Online PowerShell Module:

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Now, run the following command:

Get-AtpPolicyFor0365 | fl Name, EnableATPForSPOTeamsODB

   

      3. Now, verify the value for EnableATPForSPOTeamsODB is set to True.