Microsoft 365 safe documents configuration

In this post I describe what safe documents in Microsoft 365 are, how you can configure it and why you should enable this in your Microsoft 365 tenant.

If you are not yet familiair with safe attachments and safe links you might want to read my previous post Safe attachments and links to protect your Office 365 collaboration first.

Source: https://pixabay.com/de/illustrations/sicherheit-sichern-gesperrt-2168233/
Source: https://pixabay.com/de/illustrations/sicherheit-sichern-gesperrt-2168233/

What are safe documents?

Safe documents are a Microsoft 365 Advanced Threat Protection (ATP) feature. It protects your users from opening malicious documents which might harm your users data, privacy or even your complete IT infrastructure depending on what malicious document content is opened. ATP checks before opening it and avoids a user to open a document or leave the protected view in case ATP has recognized anything potentially malicious.

Why safe documents?

It adds another valuable layer of security for your users and infrastructure which kicks in even if someone opens a document which was not caught or categorized as malicious before by other security mechanisms. It might be the last barrier and defense if someone (accidentally) opens a document in your company to avoid a security incident with corresponding consequences for your company.

What’s required to use this capability in Microsoft 365?

Safe documents are an advanced security feature which requires the following:

  • Microsoft 365 E5 or Microsoft 365 E5 Security
    Microsoft emphasizes that it is not in Office 365 ATP plans
  • Organization Management or Security Administrator role in M365 (for configuration)
  • Office Version 2004 (12730.x) or later

How to configure it?

If the requirement are met you can configure and test it. By default it is turned off.

Please note configuring this will enable this for your complete Microsoft 365 tenant and therefore for your complete organization.

Enabling it via Admin Center

Screenshot – Go to Security & Compliance Center at https://protection.office.com
Screenshot – Go to Threat management\Policy\ATP Safe Attachments
Screenshot – Tick the checkbox “Turn on Safe Documents for Office clients …”

Maybe DON’T tick the checkbox “Allow people to click through Protected View even if Safe Documents identifies the file as malicious”.

Screenshot – Click Save

That’s it now it’s live.

Enabling it via Shell

Alternatively, you can also enable this using Exchange Online PowerShell. Example:

#Install Module 
Install-Module -Name ExchangeOnlineManagement
#Check Module availablity on system
Get-Module ExchangeOnlineManagement
#Update Module
Update-Module -Name ExchangeOnlineManagement
#Import Module
Import-Module ExchangeOnlineManagement

#Connect to EXO with MFA enabled
Connect-ExchangeOnline -UserPrincipalName <UPN> -ShowProgress $true

#Enabling safe documents but prevents users from leaving protected view
Set-AtpPolicyForO365 -EnableSafeDocs $true -AllowSafeDocsOpen $false
#Check values
Get-AtpPolicyForO365 | Format-List *SafeDocs*

#Disconnect from EXO
Disconnect-ExchangeOnline

#Uninstall Module
Uninstall-Module -Name ExchangeOnlineManagement

Validating it with Shell

Due to the fact that I’ve configured this in the Admin Center I’m just checking if the settings is set as expected.

Screenshot – Validate / verify settings

And there we go, it’s set.

Conclusion, opinion and summary

It’s very easy to configure however the licensing and client requirements are quite high. In case you met the licensing requirements you can enable it (with previous planning and testing).

Also note, you should check what your antivirus (av) client might do. In case you running a third-party av client. I did not test this having a third-party av client plus this enabled. I’d assume there should be no conflicts but there can be conflicts. So, I would not directly enable this in production without previously testing this maybe in a test tenant and a test client to ensure it works as expected before going live with safe documents.

Additional resources

Comment / Kommentar verfassen

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.