MDO Encrypted email attachment protection

🚨 The Signal: Defender for Office 365 can now quarantine emails with unscannable password-protected attachments. This enhances threat protection by preventing delivery of content that cannot be fully analyzed for malware.

The Impact

Security operations teams and administrators are affected, reducing risk from un-scanned malicious attachments.

• Security operations: Reduced risk from un-scanned malicious attachments.
• Administrators: New policy configuration for Safe Attachments.
• Users: Potential increase in quarantined password-protected emails.
• Security posture: Enhanced protection against email-borne threats.

The Action

1. Review existing Safe Attachments policies in Microsoft Defender XDR portal.
2. Navigate to Email & collaboration > Policies & rules > Threat policies > Safe Attachments.
3. Edit or create a Safe Attachments policy.
4. Enable the new opt-in setting to quarantine messages with unscannable password-protected attachments.
5. Communicate potential changes in email delivery for password-protected attachments to users.

Domain: Defender · Impact: high · Workload: Microsoft Defender