ORCA.227: Each domain has a Safe Attachments policy applied to it.
| ID | ORCA.227 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Attachments |
| Security area | Email and collaboration protection |
| Resource type | Domain |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:SI-3 Malicious Code Protection |
| MITRE ATT&CK | T1566.001, T1204.002 |
| Reads from | Exchange Online |
| Licence needed | ATP_ENTERPRISE |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Microsoft Defender for Office 365 Safe Attachments policies are applied using rules. The recipient domain condition is the most effective way of applying the Safe Attachments policy, ensuring no users are left without protection. If polices are applied using group membership make sure you cover all users through this method. Applying polices this way can be challenging, users may left unprotected if group memberships are not accurate and up to date. It is important not to rely on the ‘built-in’ Safe Links policy, as this policy only applies the minimum level of protections and should serve as a catch-all.
Remediation action
Section titled “Remediation action”Apply a Safe Attachments policy to every domain.
Related Links
Section titled “Related Links”- Microsoft 365 Defender Portal - Safe attachments
- Order and precedence of email protection
- Recommended settings for EOP and Microsoft Defender for Office 365
Mito check, based on ORCA. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.