Security Policy Errors

Fix Microsoft Defender for Office 365 Blocking Attachments and Users

Maira Mehtab Sep 21, 2026 869 views

Question details

Users or attachments are being unexpectedly blocked after activating a Microsoft 365 Advanced Threat Protection (Defender for Office 365) license.

Product: Microsoft Defender for Office 365 (formerly ATP)
Device & OS: not provided
Scenario: Configuring organizational security policies and managing user licenses in Microsoft 365.
Observed behavior: Activating an ATP license for one user appears to trigger policy enforcement that blocks other licensed users or attachments associated with the same account.

Before you start

Ensure you have global administrator or security administrator privileges in the Microsoft 365 admin center to access and modify Defender threat policies.

Solution 1Recommended

Review and Adjust Safe Attachments and Safe Links Policies

Modify your Microsoft Defender security configurations to ensure valid attachments and users are not falsely blocked by overly broad tenant policies.

Microsoft 365 Advanced Threat Protection (now Microsoft Defender for Office 365) enforces security primarily through Safe Attachments, Safe Links, and anti-phishing policies. When a license is activated, these security mechanisms may automatically apply default tenant-wide configurations that block unrecognized or unverified attachments.

Access the Defender Portal

Navigate to Threat Policies

In the left-hand navigation menu, expand 'Email & collaboration' and click on 'Policies & rules', then select 'Threat policies'.

Inspect Safe Attachments

Click on 'Safe Attachments' to view the active policies. Select the policy affecting your users to view its details.

Modify Target Audiences

Click 'Edit' under the settings or users section. Ensure the policy is scoped correctly to specific users or groups, and add necessary exclusions for users who should not be blocked.

Save and Apply

Save your changes. Repeat the process for 'Safe Links' policies if users are also experiencing blocked URLs.

Policy Propagation Time: Changes made to Microsoft Defender for Office 365 policies can take up to 30 minutes to propagate fully across your organization's tenant.

Free Microsoft Office alternative

Switch to WPS Office for a Hassle-Free Offline Experience

If strict cloud security policies and Microsoft 365 Defender configurations are disrupting your workflow and blocking valid local files, consider using WPS Office. It provides a lightweight, offline-capable environment with excellent document compatibility, allowing you to manage attachments and files without cloud-based policy interruptions.

Fully compatible with Microsoft Office formats (DOCX, XLSX, PPTX).Manage and open local email attachments without cloud security policy blocks.Lightweight installation and completely free for standard office tasks.Familiar user interface for a seamless transition from Microsoft 365.

microsoft office alternative - wps office

Frequently Asked Questions

Why is Microsoft 365 ATP now called Microsoft Defender for Office 365?

Microsoft rebranded Advanced Threat Protection (ATP) to Microsoft Defender for Office 365 to unify its security product lineup and offer comprehensive threat protection across endpoints, cloud apps, and emails under the Defender umbrella.

Can I disable Safe Attachments for a specific user?

Yes, you can create a custom Safe Attachments policy in the Microsoft Defender portal and apply it only to specific users, or you can add specific users to an exclusion list in an existing broader policy.

How long does a Safe Attachment scan usually take?

Safe Attachment scans typically take a few minutes before the email is delivered. However, if your admin configures the 'Dynamic Delivery' option, users can read the email body immediately while the attachment continues scanning in the background.

Microsoft Office Security Issues