MC424901 – (Updated) Safe Attachments policy: Retire policy action ‘Replace’ for malware detections in attachments (Phase 1)

Microsoft Exchange Logo

check before: 2022-09-16

Product:

Defender, Exchange, Microsoft 365 Defender

Platform:

Online, World tenant

Status:

Change type:

Admin impact, Retirement, Updated message

Links:

Details:

Updated January 31, 2023: We have updated the rollout timeline below. Thank you for your patience.
In Safe Attachments policies, ‘Replace’ is one of the actions that can be applied to messages that are found to contain malware. This action delivers only the message body without any of the original attachments. A replacement text attachment is added to the message to notify that the attachments were removed due to malware detection.
The ‘Replace’ action will be retired and will no longer be available in Safe Attachments policies. This retirement is implemented in two phases.
The first phase will start applying the ‘Block’ action behavior (quarantine the email) to existing policies with the ‘Replace’ action. This change will be applied automatically.
The second phase will remove the ‘Replace’ action selection from the Microsoft 365 Defender portal and related cmdlets. As part of this change, the ‘Replace’ action in any existing policies will be changed to the ‘Block’ action.

Change Category:
XXXXXXX ...

Scope:
XXXXXXX ...

Release Phase:

Created:
2022-09-03

updated:
2022-09-15

the free basic plan is required to see all details. Sign up here


A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.


changes*

DatePropertyoldnew
2023-02-01MC MessageTagNamesAdmin impact, RetirementUpdated message, Admin impact, Retirement
2023-02-01MC Last Updated09/02/2022 23:40:522023-01-31T22:16:57Z
2023-02-01MC MessagesIn Safe Attachments policies, ‘Replace’ is one of the actions that can be applied to messages that are found to contain malware. This action delivers only the message body without any of the original attachments. A replacement text attachment is added to the message to notify that the attachments were removed due to malware detection.
The ‘Replace’ action will be retired and will no longer be available in Safe Attachments policies. This retirement is implemented in two phases.
The first phase will start applying the ‘Block’ action behavior (quarantine the email) to existing policies with the ‘Replace’ action. This change will be applied automatically.
The second phase will remove the ‘Replace’ action selection from the Microsoft 365 Defender portal and related cmdlets. As part of this change, the ‘Replace’ action in any existing policies will be changed to the ‘Block’ action.
Updated January 31, 2023: We have updated the rollout timeline below. Thank you for your patience.
In Safe Attachments policies, ‘Replace’ is one of the actions that can be applied to messages that are found to contain malware. This action delivers only the message body without any of the original attachments. A replacement text attachment is added to the message to notify that the attachments were removed due to malware detection.
The ‘Replace’ action will be retired and will no longer be available in Safe Attachments policies. This retirement is implemented in two phases.
The first phase will start applying the ‘Block’ action behavior (quarantine the email) to existing policies with the ‘Replace’ action. This change will be applied automatically.
The second phase will remove the ‘Replace’ action selection from the Microsoft 365 Defender portal and related cmdlets. As part of this change, the ‘Replace’ action in any existing policies will be changed to the ‘Block’ action.
2023-02-01MC How AffectOnce this change is rolled out, any Safe Attachments policies with the ‘Replace’ action will not be honored and the action of ‘Block’ will apply automatically.
The phase 1 change will start rolling out in late-September 2022 and worldwide deployment will be complete by late-October 2022. For Government clouds, the deployment will start in mid-November 2022 and will be complete by mid-December 2022.
Once this change is rolled out, any Safe Attachments policies with the ‘Replace’ action will not be honored and the action of ‘Block’ will apply automatically.
The phase 1 change will start rolling out in late-September 2022 and worldwide deployment will be complete by late-October 2022.
Government: has begun rolling out and expect to complete by mid-February.
2023-02-01MC TitleSafe Attachments policy: Retire policy action ‘Replace’ for malware detections in attachments (Phase 1)(Updated) Safe Attachments policy: Retire policy action ‘Replace’ for malware detections in attachments (Phase 1)
2023-02-01MC End Time01/31/2023 09:00:002023-03-31T10:00:00Z
2022-09-15MC prepareThere are no alternatives to the ‘Replace’ action post retirement. Review and update Safe Attachments policies with the ‘Replace’ action to a different action (for example, ‘Block’ or ‘Dynamic Delivery’) before the phase 2 rollout.
Please click Additional Information to learn more.
SafeAttachments
Safe Attachments policy settings
ps://docs.microsoft.com/microsoft-365/security/office-365-security/safe-attachments?view=o365-world
ps://docs.microsoft.com/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide#safe-attachments-policy-setti
There are no alternatives to the ‘Replace’ action post retirement. Review and update Safe Attachments policies with the ‘Replace’ action to a different action (for example, ‘Block’ or ‘Dynamic Delivery’) before the phase 2 rollout.
Please click Additional Information to learn more.
SafeAttachments
Safe Attachments policy settings
https://docs.microsoft.com/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide
https://docs.microsoft.com/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide#safe-attachments-policy-settings

*starting April 2022

Last updated 4 days ago

Share to MS Teams

Login to your account

Welcome Back, We Missed You!