*For this entry exists the more relevant or more recent entry MC525759
check before: 2022-09-16
Product:
Defender, Exchange, Microsoft 365 Defender
Platform:
Online, World tenant
Status:
Change type:
Admin impact, Retirement, Updated message
Links:
Details:
Updated February 9, 2023: We have updated the rollout timeline below. Thank you for your patience.
In Safe Attachments policies, ‘Replace’ is one of the actions that can be applied to messages that are found to contain malware. This action delivers only the message body without any of the original attachments. A replacement text attachment is added to the message to notify that the attachments were removed due to malware detection.
The ‘Replace’ action will be retired and will no longer be available in Safe Attachments policies. This retirement is implemented in two phases.
The first phase will start applying the ‘Block’ action behavior (quarantine the email) to existing policies with the ‘Replace’ action. This change will be applied automatically.
The second phase will remove the ‘Replace’ action selection from the Microsoft 365 Defender portal and related cmdlets. As part of this change, the ‘Replace’ action in any existing policies will be changed to the ‘Block’ action.
Change Category:
XXXXXXX ...
Scope:
XXXXXXX ...
Release Phase:
Created:
2022-09-03
updated:
2022-09-15
the free basic plan is required to see all details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
changes*
| Date | Property | old | new |
| 2023-02-10 | MC Messages | Updated January 31, 2023: We have updated the rollout timeline below. Thank you for your patience.
In Safe Attachments policies, ‘Replace’ is one of the actions that can be applied to messages that are found to contain malware. This action delivers only the message body without any of the original attachments. A replacement text attachment is added to the message to notify that the attachments were removed due to malware detection. The ‘Replace’ action will be retired and will no longer be available in Safe Attachments policies. This retirement is implemented in two phases. The first phase will start applying the ‘Block’ action behavior (quarantine the email) to existing policies with the ‘Replace’ action. This change will be applied automatically. The second phase will remove the ‘Replace’ action selection from the Microsoft 365 Defender portal and related cmdlets. As part of this change, the ‘Replace’ action in any existing policies will be changed to the ‘Block’ action. | Updated February 9, 2023: We have updated the rollout timeline below. Thank you for your patience.
In Safe Attachments policies, ‘Replace’ is one of the actions that can be applied to messages that are found to contain malware. This action delivers only the message body without any of the original attachments. A replacement text attachment is added to the message to notify that the attachments were removed due to malware detection. The ‘Replace’ action will be retired and will no longer be available in Safe Attachments policies. This retirement is implemented in two phases. The first phase will start applying the ‘Block’ action behavior (quarantine the email) to existing policies with the ‘Replace’ action. This change will be applied automatically. The second phase will remove the ‘Replace’ action selection from the Microsoft 365 Defender portal and related cmdlets. As part of this change, the ‘Replace’ action in any existing policies will be changed to the ‘Block’ action. |
| 2023-02-10 | MC Last Updated | 01/31/2023 22:16:57 | 2023-02-09T22:12:18Z |
| 2023-02-01 | MC MessageTagNames | Admin impact, Retirement | Updated message, Admin impact, Retirement |
| 2023-02-01 | MC Last Updated | 09/02/2022 23:40:52 | 2023-01-31T22:16:57Z |
| 2023-02-01 | MC Messages | In Safe Attachments policies, ‘Replace’ is one of the actions that can be applied to messages that are found to contain malware. This action delivers only the message body without any of the original attachments. A replacement text attachment is added to the message to notify that the attachments were removed due to malware detection.
The ‘Replace’ action will be retired and will no longer be available in Safe Attachments policies. This retirement is implemented in two phases. The first phase will start applying the ‘Block’ action behavior (quarantine the email) to existing policies with the ‘Replace’ action. This change will be applied automatically. The second phase will remove the ‘Replace’ action selection from the Microsoft 365 Defender portal and related cmdlets. As part of this change, the ‘Replace’ action in any existing policies will be changed to the ‘Block’ action. | Updated January 31, 2023: We have updated the rollout timeline below. Thank you for your patience.
In Safe Attachments policies, ‘Replace’ is one of the actions that can be applied to messages that are found to contain malware. This action delivers only the message body without any of the original attachments. A replacement text attachment is added to the message to notify that the attachments were removed due to malware detection. The ‘Replace’ action will be retired and will no longer be available in Safe Attachments policies. This retirement is implemented in two phases. The first phase will start applying the ‘Block’ action behavior (quarantine the email) to existing policies with the ‘Replace’ action. This change will be applied automatically. The second phase will remove the ‘Replace’ action selection from the Microsoft 365 Defender portal and related cmdlets. As part of this change, the ‘Replace’ action in any existing policies will be changed to the ‘Block’ action. |
| 2023-02-01 | MC How Affect | Once this change is rolled out, any Safe Attachments policies with the ‘Replace’ action will not be honored and the action of ‘Block’ will apply automatically.
The phase 1 change will start rolling out in late-September 2022 and worldwide deployment will be complete by late-October 2022. For Government clouds, the deployment will start in mid-November 2022 and will be complete by mid-December 2022. | Once this change is rolled out, any Safe Attachments policies with the ‘Replace’ action will not be honored and the action of ‘Block’ will apply automatically.
The phase 1 change will start rolling out in late-September 2022 and worldwide deployment will be complete by late-October 2022. Government: has begun rolling out and expect to complete by mid-February. |
| 2023-02-01 | MC Title | Safe Attachments policy: Retire policy action ‘Replace’ for malware detections in attachments (Phase 1) | (Updated) Safe Attachments policy: Retire policy action ‘Replace’ for malware detections in attachments (Phase 1) |
| 2023-02-01 | MC End Time | 01/31/2023 09:00:00 | 2023-03-31T10:00:00Z |
| 2022-09-15 | MC prepare | There are no alternatives to the ‘Replace’ action post retirement. Review and update Safe Attachments policies with the ‘Replace’ action to a different action (for example, ‘Block’ or ‘Dynamic Delivery’) before the phase 2 rollout.
Please click Additional Information to learn more. SafeAttachments Safe Attachments policy settings ps://docs.microsoft.com/microsoft-365/security/office-365-security/safe-attachments?view=o365-world ps://docs.microsoft.com/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide#safe-attachments-policy-setti | There are no alternatives to the ‘Replace’ action post retirement. Review and update Safe Attachments policies with the ‘Replace’ action to a different action (for example, ‘Block’ or ‘Dynamic Delivery’) before the phase 2 rollout.
Please click Additional Information to learn more. SafeAttachments Safe Attachments policy settings https://docs.microsoft.com/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide https://docs.microsoft.com/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide#safe-attachments-policy-settings |
*starting April 2022
Last updated 12 months ago
