Message ID: MC918563
We will retire the Monitor action in the Safe attachments policy in Microsoft Exchange Online Protection (Microsoft Defender for Office 365) starting late February 2025 and ending by late May 2025.
[How this will affect your organization:]
A Safe attachments policy provides an additional layer of protection against malicious content (attachments) in emails by analyzing attachment content and behavior in a sandbox environment. This policy provides four actions: Off, Monitor, Block, and Dynamic delivery. We made the Monitor action available for customers who wanted a Safe attachments policy to process attachments, deliver the emails (without blocking malicious attachments), and track what happened with attachments identified as malicious. Customers used reports to see detections from the Monitor action in the policy.
As part of this retirement, if your organization has Safe attachments policies set to the Monitor action, we will automatically change the action in from Monitor to Block. We will not change the policy’s recipients, status, or priority. After retirement, the Monitor option will not be available in the Safe Attachments policy page in the Defender security portal or the corresponding Microsoft PowerShell cmdlet.
Before retirement, you can find the Monitor action in Defender > Email & collaboration > Policies & rules > Threat policies > Safe attachments > choose a policy or create a new policy > Edit settings (or Settings if creating a new policy). We will also retire Redirect messages with detected attachments, because this option only supports the Monitor action):
After the retirement, the only actions in the Safe attachments policy will be Off, Block, and Dynamic delivery.
[What you need to do to prepare:]
Before the retirement, review your Safe attachments policies and take appropriate action if your organization has Safe attachments policies set to the Monitor action. We recommend changing the action from Monitor to Block.
Alternatively, if you still need to run Safe attachment policy in audit mode, we recommend using Evaluation mode. Learn more about Evaluation mode.
You can also review detections by Evaluation mode policies using the Threat Protection Status report.
Learn more: The Safe Attachment policy settings section of Safe Attachments – Microsoft Defender for Office 365 | Microsoft Learn
Source: Microsoft
The retirement of the “Monitor” action in the Safe attachments policy in Microsoft Exchange Online Protection (Microsoft Defender for Office 365) is on the horizon! This change will impact admins and users alike, so let’s dive into what this means for you.
For admins, this change will require a bit of adjustment. If your organization currently has Safe attachments policies set to the Monitor action, Microsoft will automatically switch it to Block. Don’t worry, your policy’s recipients, status, and priority will remain unchanged. Just remember, after the retirement, the Monitor option will no longer be available in the Defender security portal or through PowerShell cmdlets. It’s time to embrace the Block, Off, and Dynamic delivery actions!
Now, for the users, this update might go unnoticed, but it’s all part of keeping your email attachments safe and secure. The behind-the-scenes work of analyzing attachment content and behavior in a sandbox environment will continue, just with a different approach.
To prepare for this change, admins, review your Safe attachments policies and switch from Monitor to Block if needed. And if you still require audit mode, try out Evaluation mode instead. It’s like switching from a Monitor lizard to a Block party – equally exciting!
So, let’s adapt together and ensure our email attachments stay safe and sound. Feel free to share your thoughts on how this update will impact you or any tips you have for fellow readers. Let’s keep the conversation going!