MC544793 – AntiMalware: Default Policy (only): Common attachment filter: Configuration Change

Product:

Defender, Exchange, Microsoft 365 Defender, Microsoft 365 suite

Platform:

Online, World tenant

Status:

Change type:

Feature update, Admin impact

Links:

Details:

We're making some changes to common attachment filter settings for the Default policy (only) in the Anti-malware policy. The earlier default selection value of the 'Quarantine the message' is changed to 'Reject the message with NDR'.

In Anti-malware policies, under the protection settings for ‘Enable the common attachment filter’, there are two notification options when an email contains any attachment matching the configured file types. They are:
Reject the message with a non-delivery receipt (NDR)
Quarantine the message.
These two notification options are added to the common attachments filter few months ago. When this was added, the option ‘Quarantine the message’ was selected in the default policy.
The change now being introduced is to update this option to ‘Reject the message with a non-delivery receipt (NDR)’ for all customers. This change is to allow faster response on the part of the sender to resend any important emails which might be quarantined (and delayed to the intended receipt) due to any attachment with matching blocked file type. We’re also aligning the setting for this control in the Standard and Strict preset security policies to ‘Reject the message with a non-delivery receipt (NDR)’. This change will also reduce the messages in quarantine. Quarantined messages need to be reviewed and released by the SecOps team and allow the sender to take action.
[When will this happen:]
We will begin rolling this out early May and expect to complete by mid-June.

Change Category:
XXXXXXX ...

Scope:
XXXXXXX ...

Release Phase:

Created:
2023-04-22

updated:
2023-04-22