# Anti Malware Policy (Default) > Comprehensive anti-malware protection for Exchange Online — blocks known malicious file attachment types and alerts administrators when internal senders are de… Comprehensive anti-malware protection for Exchange Online — blocks known malicious file attachment types and alerts administrators when internal senders are detected sending malware. ## Settings this baseline controls | Setting | What it does | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | File filter enabled | Enables or disables the common attachments filter. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Blocked file types | List of file extensions to block. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Blocked file action | An NDR email will be sent to the sender. the message will not be quarantined , and no recipient or admin notifications will be sent. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Quarantine policy | Permission to release quarantined messages will be ignored for messages with malware detected and we will fall back to release request instead. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Internal sender notifications enabled | Enables or disables admin notifications when an internal sender is detected sending malware. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Internal sender notification email | Email address to receive internal sender malware notifications. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | External sender notifications enabled | Enables or disables admin notifications when an external sender is detected sending malware. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | External sender notification email | Email address to receive external sender malware notifications. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | **8 more settings** | Setting | What it does | | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Custom notifications enabled | Replace the default notification text with customized text for admin notifications. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Notification sender name | The display name to use in custom notification messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Notification sender address | The email address to use in custom notification messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Internal notification subject | The subject line to use in custom internal sender notification messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Internal notification message | The body content to use in custom internal sender notification messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | External notification subject | The subject line to use in custom external sender notification messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | External notification message | The body content to use in custom external sender notification messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | | Zero-hour auto purge enabled | Enables or disables zero-hour auto purge (ZAP) for malware in cloud mailboxes. ZAP detects malware in unread messages that have already been delivered to the user's Inbox. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this baseline to the tenant to turn on Exchange Online's anti-malware protection for every mailbox, or bundle it into a scheme you deploy to many tenants at once. 1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. **Turn on file filtering.** Set **File filter enabled** on and **Blocked file action** to `Quarantine`, so a message carrying one of the blocked file types is held rather than delivered or silently dropped. 3. **Set the quarantine policy.** Set **Quarantine policy** to `DefaultFullAccessPolicy`, so senders and recipients can see and release their own quarantined mail rather than waiting on an admin. 4. **Leave sender notifications off.** Leave **Internal sender notifications enabled** and **External sender notifications enabled** off, unless your organisation also wants malware alerts emailed to an admin address. Keep **Zero-hour auto purge enabled** on, so a message is pulled back out of a mailbox as soon as Microsoft identifies it as malware, even after delivery. 5. **Save.** Turn on **Auto-remediation** ([Remediation](https://docs.octiga.io/baselines/remediation/)) if you want Octiga to restore these values whenever the Default policy changes. End users see nothing unless malware arrives. ## Check it worked Passing means the Default anti-malware policy in Exchange Online has these settings. You can confirm it in the Microsoft Defender portal under **Email & collaboration → Policies & rules → Threat policies → Anti-malware**. End users notice this baseline only when a message is blocked: it doesn't reach their mailbox, and the sender gets a rejection instead. ## Standards this addresses ### CIS - **M365 2.1.2** — CIS M365 Foundations Benchmark 2.1.2 - **M365 2.1.3** — CIS M365 Foundations Benchmark 2.1.3 - **v8 10.1** — CIS Controls v8 Safeguard 10.1 ### NIST - **PR.DS-4** — NIST CSF 2.0 PR.DS-4 - **SI-3** — NIST SP 800-53 SI-3 - **SC-7** — NIST SP 800-53 SC-7 ### ISO 27001 - **A.8.7** — ISO/IEC 27001:2022 Annex A.8.7 - **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)