Safe Documents in Microsoft 365 E5

Important

Welcome to Microsoft Defender for Office 365, the new name for Office 365 Advanced Threat Protection. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.

Safe Documents is a feature in Microsoft 365 E5 or Microsoft 365 E5 Security that uses Microsoft Defender Advanced Threat Protection to scan documents and files that are opened in Protected View.

What do you need to know before you begin?

  • Safe Documents is available only to users with Microsoft 365 E5 or Microsoft 365 E5 Security licenses. These licenses are not included in Office 365 Advanced Threat Protection (ATP) plans.

  • You open the Security & Compliance Center at https://protection.office.com. To go directly to the ATP Safe Attachments page, open https://protection.office.com/safeattachmentv2.

  • To connect to Exchange Online PowerShell, see Connect to Exchange Online PowerShell.

  • You need to be assigned permissions before you can perform the procedures in this topic. To enable and configure Safe Documents, you need to be a member of the Organization Management or Security Administrator role groups. For more information about role groups in the Security & Compliance Center, see Permissions in the Security & Compliance Center.

How does Microsoft handle your data?

To keep you protected, Safe Documents sends files to the Microsoft Defender Advanced Threat Protection cloud for analysis. Details on how Microsoft Defender ATP handles your data can be found here: Microsoft Defender ATP data storage and privacy.

Files sent by Safe Documents are not retained in Defender beyond the time needed for analysis (typically, less than 24 hours).

Use the Security & Compliance Center to configure Safe Documents

  1. In the Security & Compliance Center, go to Threat management > Policy > ATP Safe Attachments, and then click Global settings.

  2. In the Global settings fly out that appears, configure the following settings:

    • Turn on Safe Documents for Office clients: Move the toggle to the right to turn on the feature: Toggle on.

    • Allow people to click through Protected View even if Safe Documents identifies the file as malicious: We recommend that you leave this option turned off (leave the toggle to the left: Toggle off).

    When you're finished, click Save.

    Safe Documents settings after selecting Global settings on the ATP Safe Attachments page.

Use Exchange Online PowerShell to configure Safe Documents

Use the following syntax:

Set-AtpPolicyForO365 -EnableSafeDocs <$true | $false> -AllowSafeDocsOpen <$true | $false>
  • The EnableSafeDocs parameter enables or disables Safe Documents for the entire organization.
  • The AllowSafeDocsOpen parameter allows or prevents users from leaving Protected View (that is, opening the document) if the document has been identified as malicious.

This example enables Safe Documents for the entire organization, and prevents users from opening documents that have been identified as malicious from Protected View.

Set-AtpPolicyForO365 -EnableSafeDocs $true -AllowSafeDocsOpen $false

For detailed syntax and parameter information, see Set-AtpPolicyForO365.

How do I know this worked?

To verify that you've enabled and configured Safe Documents, do any of the following steps:

  • In the Security & Compliance Center, go to Threat management > Policy > ATP Safe Attachments, click Global settings, and verify the Turn on Safe Documents for Office clients and Allow people to click through Protected View even if Safe Documents identifies the file as malicious settings.

  • Run the following command in Exchange Online PowerShell and verify the property values:

    Get-AtpPolicyForO365 | Format-List *SafeDocs*
    
  • The following files are available to test Safe Documents protection. These documents are similar to the EICAR.TXT file for testing anti-malware and anti-virus solutions. The files are not harmful, but they will trigger Safe Documents protection.