Safe Attachments

Safe Attachments is the Microsoft Defender for Office 365 feature that detonates email attachments in a sandbox before delivering them. Unknown files (anything not on the safe list and not already known malware) are run in a virtualised environment; if they exhibit malicious behaviour, they're blocked, otherwise delivered. Three policy modes: Block (hold all detonations until complete — adds delivery latency), Dynamic Delivery (deliver the email body immediately, scan attachments in parallel, deliver attachments when clean — the recommended default), and Replace (replace attachments with a notification while scanning). Also applies to SharePoint, OneDrive, and Teams files. Requires Defender for Office 365 Plan 1 or higher.

Worked example

An invoice arrives with an attached macro-enabled spreadsheet from a sender the finance team has never dealt with before. Under Dynamic Delivery, the email body reaches the inbox immediately with a placeholder in place of the attachment, while Safe Attachments detonates the real file in an isolated sandbox in parallel; when the macro tries to reach out to a suspicious external server during detonation, the file is flagged as malicious and the placeholder is replaced with a block notice rather than the original attachment ever reaching the user's device.

Common pitfalls

Choosing the Block policy mode for every mailbox because it "sounds most secure" ignores the delivery latency it adds to every single email with an attachment — Dynamic Delivery gives the same detonation protection while letting users read the message body immediately, which is why Microsoft recommends it as the default. Assuming Safe Attachments only matters for email misses that it also scans files landing in SharePoint, OneDrive, and Teams — a malicious file shared via a Teams chat gets the same sandbox treatment as one arriving by email. And treating "no detection" during the sandbox window as a permanent guarantee overlooks that detonation checks behaviour observed during that specific run; a sophisticated file designed to stay dormant during automated analysis and activate later can still slip through, which is why Safe Attachments is one layer in a defence-in-depth strategy, not a single point of trust.