ORCA.225 - Safe Documents is enabled for Office clients.
Overview
Safe Documents can assist protecting files opened in Office appplications. Before a user is allowed to trust a file opened in Office 365 ProPlus using Protected View, the file will be verified by Microsoft Defender for Office 365.
Remediation action
Enable Safe Documents for Office clients.
Related Links
- Microsoft 365 Defender Portal - Safe attachments
- Recommended settings for EOP and Microsoft Defender for Office 365
- Safe Documents in Microsoft 365 E5
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.225 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Feature | Safe Attachments |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.002 Malicious File |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA225 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.225.ps1 - Documentation:
tests/orca/Test.ORCA.225.md