> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/defender/safe-attachments.md).

# Safe Attachments

Safe Attachments protects against malware and other malicious content hidden inside email attachments. Rather than relying only on signature-based scanning, Safe Attachments detonates each attachment in an isolated sandbox environment ("detonation chamber") before it reaches the recipient, catching zero-day and previously-unseen malware that a signature scanner alone would miss.

{% hint style="info" %}
Safe Attachments requires **Defender for Office 365 Plan 1** at minimum. See the main [Defender](/modules/secure/defender.md) page for how templates, baselines, and deployment work generally.
{% endhint %}

## What you can configure

A Safe Attachments template is intentionally simple — three settings:

* **Detection response** (`Action`) — what happens to a message when its attachment is flagged as malicious:
  * **Block** — the message is blocked outright (Microsoft's and Augmentt's recommended default).
  * **Allow** — deliver the message anyway (not recommended; effectively disables enforcement while still logging detections).
  * **Monitor** — deliver the message and just log the detection for visibility.
  * (**Replace** was a supported action in earlier product versions.)
* **Enable redirect** (`Redirect` / `RedirectAddress`) — instead of (or alongside) the detection response above, redirect flagged messages to a specified mailbox — typically a security team's review inbox — rather than blocking them outright or letting them through untouched.
* **Quarantine policy** (`QuarantineTag`) — which quarantine policy governs who can see, release, or preview a message quarantined by this Safe Attachments policy (for example `AdminOnlyAccessPolicy`, restricting release rights to admins only).

## Augmentt's default template

Augmentt ships one baseline out-of-the-box Safe Attachments template:

### Safe attachments - Secure Score recommendations

| Setting                       | Value                 |
| ----------------------------- | --------------------- |
| Enable Safe Attachments       | On                    |
| Detection response (`Action`) | Block                 |
| Enable redirect               | Off                   |
| Redirect address              | (none)                |
| Quarantine policy             | AdminOnlyAccessPolicy |

This matches Microsoft's own recommended Standard *and* Strict preset values for Safe Attachments — Microsoft, like Augmentt, doesn't vary this policy type's core settings between its two preset tiers (Block + AdminOnlyAccessPolicy is the recommendation at both levels). There is currently no separate "more aggressive" Safe Attachments variant in Augmentt's template library.

**Resolves posture check(s):**

* **MDOSAFEATTACHMENTS** and **MDOSAFEATTACHMENTPOLICY** — the Secure-Score-sourced checks confirming a Safe Attachments policy exists and is properly configured. Mapped to CMMC Level 1 (SI.L1-b.1.xiii/xv — Malicious Code Protection & Scanning), CMMC Level 2 (SI.L2-3.14.2/3.14.5 — Scan Inbound Attachments), HIPAA §164.308(a)(5)(ii)(B), and NIST CSF 2.0 DE.CM-09.
* **CIS\_M365 §2.1.4 — "Ensure Safe Attachments policy is enabled"** (CIS Microsoft 365 Foundations Benchmark v6/v7, Level 2).
* **SAFEATTACHMENT (CISA SCuBA)** — "Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams" and **CIS\_M365 §2.1.5** ("Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled"). Note these two checks are about the tenant-wide *Built-In Protection* toggle for SharePoint/OneDrive/Teams scanning, which is a separate Microsoft-level setting — it isn't part of the deployable `SafeAttachmentPolicy` object this template configures, so deploying this template alone does not remediate those two checks. They're mapped here because they share the "Safe Attachments" name and detonation mechanism, not because Augmentt's Safe Attachments template controls them.

## Deploying and troubleshooting

Deployment mechanics are the same across Defender policy types — see the main [Defender](/modules/secure/defender.md) page. Safe Attachments needs at least **Exchange Administrator** on the connection to write.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/defender/safe-attachments.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.