Anti Malware Policy (Default)
Comprehensive anti-malware protection for Exchange Online — blocks known malicious file attachment types and alerts administrators when internal senders are detected sending malware.
Settings this baseline controls
| Setting | What it does |
|---|---|
| File filter enabled | Enables or disables the common attachments filter. Learn more |
| Blocked file types | List of file extensions to block. Learn more |
| Blocked file action | An NDR email will be sent to the sender. the message will not be quarantined , and no recipient or admin notifications will be sent. Learn more |
| Quarantine policy | Permission to release quarantined messages will be ignored for messages with malware detected and we will fall back to release request instead. Learn more |
| Internal sender notifications enabled | Enables or disables admin notifications when an internal sender is detected sending malware. Learn more |
| Internal sender notification email | Email address to receive internal sender malware notifications. Learn more |
| External sender notifications enabled | Enables or disables admin notifications when an external sender is detected sending malware. Learn more |
| External sender notification email | Email address to receive external sender malware notifications. Learn more |
8 more settings
| Setting | What it does |
|---|---|
| Custom notifications enabled | Replace the default notification text with customized text for admin notifications. Learn more |
| Notification sender name | The display name to use in custom notification messages. Learn more |
| Notification sender address | The email address to use in custom notification messages. Learn more |
| Internal notification subject | The subject line to use in custom internal sender notification messages. Learn more |
| Internal notification message | The body content to use in custom internal sender notification messages. Learn more |
| External notification subject | The subject line to use in custom external sender notification messages. Learn more |
| External notification message | The body content to use in custom external sender notification messages. Learn more |
| Zero-hour auto purge enabled | Enables or disables zero-hour auto purge (ZAP) for malware in cloud mailboxes. ZAP detects malware in unread messages that have already been delivered to the user’s Inbox. Learn more |
Configure it
Add this baseline to the tenant to turn on Exchange Online’s anti-malware protection for every mailbox, or bundle it into a scheme you deploy to many tenants at once.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Turn on file filtering.
Set File filter enabled on and Blocked file action to
Quarantine, so a message carrying one of the blocked file types is held rather than delivered or silently dropped. -
Set the quarantine policy.
Set Quarantine policy to
DefaultFullAccessPolicy, so senders and recipients can see and release their own quarantined mail rather than waiting on an admin. -
Leave sender notifications off.
Leave Internal sender notifications enabled and External sender notifications enabled off, unless your organisation also wants malware alerts emailed to an admin address. Keep Zero-hour auto purge enabled on, so a message is pulled back out of a mailbox as soon as Microsoft identifies it as malware, even after delivery.
-
Save.
Turn on Auto-remediation (Remediation) if you want Octiga to restore these values whenever the Default policy changes. End users see nothing unless malware arrives.
Check it worked
Passing means the Default anti-malware policy in Exchange Online has these settings. You can confirm it in the Microsoft Defender portal under Email & collaboration → Policies & rules → Threat policies → Anti-malware. End users notice this baseline only when a message is blocked: it doesn’t reach their mailbox, and the sender gets a rejection instead.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.