Safe Attachments

Safe Attachments is the Microsoft Defender for Office 365 feature that detonates email attachments in a sandbox before delivering them. Unknown files (anything not on the safe list and not already known malware) are run in a virtualised environment; if they exhibit malicious behaviour, they're blocked, otherwise delivered. Three policy modes: Block (hold all detonations until complete — adds delivery latency), Dynamic Delivery (deliver the email body immediately, scan attachments in parallel, deliver attachments when clean — the recommended default), and Replace (replace attachments with a notification while scanning). Also applies to SharePoint, OneDrive, and Teams files. Requires Defender for Office 365 Plan 1 or higher.