# Safe Attachments Policy (Octiga) > Microsoft Defender for Office 365 Safe Attachments scans email attachments in a virtual sandbox environment before delivering them to recipients. Microsoft Defender for Office 365 Safe Attachments scans email attachments in a virtual sandbox environment before delivering them to recipients. The Default policy defines how attachments are handled when malware is detected, helping protect users from zero-day malware and other malicious content delivered via email. ## Settings this baseline controls | Setting | What it does | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Policy name | The name of the Safe Attachments policy. The Default policy applies to all users without a specific policy assignment. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safeattachmentpolicy?view=exchange-ps) | | Safe Attachments enabled | Enables or disables the Safe Attachments policy. When enabled, email attachments are scanned in a sandbox before delivery. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safeattachmentpolicy?view=exchange-ps) | | Unknown malware response | The action to take when malware is detected in an attachment. Options: Allow (off, no scanning), Block (block and quarantine the message), DynamicDelivery (deliver the message with a placeholder, replace with the original after scanning). [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safeattachmentpolicy?view=exchange-ps) | | Quarantine policy | The quarantine policy applied to messages that are quarantined by Safe Attachments. Determines end-user permissions for quarantined messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safeattachmentpolicy?view=exchange-ps) | | Redirect enabled | Whether to redirect messages containing detected malware to a specified email address. Used in audit scenarios. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safeattachmentpolicy?view=exchange-ps) | | Redirect email address | The email address to redirect messages to when malware is detected, if Redirect is enabled. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safeattachmentpolicy?view=exchange-ps) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it This baseline turns on Safe Attachments, which scans email attachments in a sandbox before they're delivered. 1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. **Turn it on and set the response to malware.** Set **Safe Attachments enabled** on and **Unknown malware response** to `Block`, so a detected attachment is quarantined along with its message rather than delivered with a placeholder or allowed through unscanned. 3. **Set the quarantine policy.** Set **Quarantine policy** to `AdminOnlyAccessPolicy`, so only an admin can release a message Safe Attachments has quarantined. 4. **Leave redirection off.** Leave **Redirect enabled** off. Redirecting detected malware to a separate mailbox is mainly useful for auditing and isn't needed for standard protection. 5. **Check where this policy sits relative to any others.** Octiga creates and manages its own policy, named **Octiga Safe Attachment Policy**, rather than editing an existing one. Safe Attachments policies apply in priority order, and a Strict or Standard preset security policy assigned to the same recipients is evaluated first. If a preset already covers everyone this baseline targets, this policy's settings never take effect for them (see [Preset EOP Policy (Standard)](https://docs.octiga.io/baselines/email-security/preset-eop-protection-policy-rule-standard/) and [Preset EOP Policy (Strict)](https://docs.octiga.io/baselines/email-security/preset-eop-protection-policy-rule-strict/)). 6. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply this whenever it's changed (see [Remediation](https://docs.octiga.io/baselines/remediation/)). > **Licence: Defender for Office 365:** Safe Attachments needs Defender for Office 365. Without it, this baseline is skipped rather than reported as a deviation (see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/)). ## Check it worked Passing means the **Octiga Safe Attachment Policy** exists, is on, and matches these settings. Check it in the Microsoft Defender portal, under **Email & collaboration → Policies & rules → Threat policies → Safe attachments**. Users don't see attachments being scanned; they notice only when one is quarantined. ## Standards this addresses ### CIS - **M365 2.1.4** — CIS M365 Foundations Benchmark 2.1.4 - **M365 2.1.5** — CIS M365 Foundations Benchmark 2.1.5 - **v8 9.7** — CIS Controls v8 Safeguard 9.7 - **v8 10.1** — CIS Controls v8 Safeguard 10.1 ### NIST - **PR.DS-4** — NIST CSF 2.0 PR.DS-4 - **SI-3** — NIST SP 800-53 SI-3 - **SC-7** — NIST SP 800-53 SC-7 ### ISO 27001 - **A.8.7** — ISO/IEC 27001:2022 Annex A.8.7 - **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)