What Data Types Does Microsoft Defender Safe Attachments Scan?
Question details
The user wants to know if Microsoft Defender for Office 365 Safe Attachments scans and detonates specific archive formats like RAR files.
- Product
- Microsoft Defender for Office 365
- Device & OS
- not provided
- Scenario
- Receiving email attachments and relying on Exchange Online Protection to filter out potentially malicious content.
- Observed behavior
- Users need clarification on whether archive files like .rar undergo detonation or sandboxing within the Safe Attachments environment.
Ensure you have administrative access to your Microsoft 365 Defender portal to review or configure Safe Attachments policies, and verify that your subscription includes Microsoft Defender for Office 365 Plan 1 or Plan 2.
Understanding Safe Attachments Scanning and Detonation
Learn how Microsoft Defender handles archive files like .rar through its sandboxing environment.
Safe Attachments acts as an additional layer of security by routing eligible email attachments to an isolated virtual machine environment. Here, the attachments are 'detonated' to observe their behavior and detect malicious activity before reaching the user's inbox.
Supported archive formats, including .rar files, are indeed scanned by this service. The system extracts the contents of the archive and analyzes the individual files within to ensure no malware is hidden.
Log in to the Microsoft 365 Defender portal at security.microsoft.com using an administrator account.
In the left-hand navigation pane, go to 'Email & collaboration', click on 'Policies & rules', and then select 'Threat policies'.
Click on 'Safe Attachments' to view or configure the global settings that determine how the system handles scanned, unknown, or malicious attachments, including archive formats.
Choose WPS Office for a Secure and Lightweight Experience
If you are evaluating your Office software ecosystem, WPS Office provides a reliable, fast, and free alternative to Microsoft Office. It offers robust document creation and editing capabilities without heavy resource requirements while maintaining excellent compatibility with Office file formats.
- 1. Download WPS Office: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Software: Run the downloaded installer file and follow the straightforward on-screen instructions to complete the setup.
- 3. Open Office Documents: Launch WPS Office and instantly open your existing .docx, .xlsx, or .pptx files to start working without any formatting loss.
Frequently Asked Questions
Does Exchange Online Protection (EOP) scan attachments if Safe Attachments is disabled?
Yes, EOP includes built-in anti-malware and content filtering that scans attachments using signature-based detection. However, Safe Attachments provides an extra layer of zero-day protection via active sandboxing and detonation.
What happens if Safe Attachments detects a malicious RAR file?
Depending on your specific policy settings, the email can be outright blocked, the attachment can be replaced with a warning message, or the message can be sent to quarantine for your administrator to review.
Are password-protected RAR archives scanned by Microsoft Defender?
Safe Attachments cannot automatically extract and detonate files inside password-protected or encrypted archives unless it has the password. These files are typically handled according to your specific policy rules regarding encrypted attachments.
Is there a file size limit for Safe Attachments detonation?
Yes, Microsoft Defender has specific message and attachment size limits. Attachments exceeding these limits might bypass detonation, so it is highly recommended to configure threat policies that block excessively large executable files or archives.
