MC918563 – Microsoft Exchange Online Protection (Defender for Office 365): Monitor action in Safe attachments policy will retire (archived)

Product:

Defender, Defender for Office 365, Defender XDR, Exchange

Platform:

Online, World tenant

Status:

Change type:

Admin impact, Retirement

Links:

Details:

Summary:
The Monitor action in the Safe attachments policy for Microsoft Exchange Online Protection will be retired from early July 2025 to late August 2025. Organizations using the Monitor action will have it automatically changed to Block. The only remaining actions will be Off, Block, and Dynamic delivery.

Details:
Updated June 4, 2025: We have updated the timeline below. Thank you for your patience.
We will retire the Monitor action in the Safe attachments policy in Microsoft Exchange Online Protection (Microsoft Defender for Office 365) starting early July 2025 (previously late March) and ending by late August 2025 (previously late May).

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2024-10-26

updated:
2025-06-05

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Change in Safe Attachments Policy Action
The automatic change from Monitor to Block will prevent users from receiving emails with potentially malicious attachments, impacting their ability to access necessary information.
   - roles: Email Administrators, End Users
   - references: https://learn.microsoft.com/defender-office-365/safe-attachments-about#safe-attachments-policy-settings

Increased Risk of Malicious Attachments
Without the Monitor action, users may be exposed to malicious attachments that would have been flagged, increasing the risk of security incidents.
   - roles: Security Analysts, End Users
   - references: https://learn.microsoft.com/defender-office-365/safe-attachments-about#safe-attachments-policy-settings

Loss of Monitoring Capabilities
The retirement of the Monitor action means organizations will lose the ability to track and analyze potentially harmful attachments, hindering incident response efforts.
   - roles: Security Analysts, Compliance Officers
   - references: https://learn.microsoft.com/defender-office-365/safe-attachments-about#safe-attachments-policy-settings

User Experience Degradation
Users may experience frustration and confusion due to sudden blocking of emails that previously would have been monitored, leading to potential workflow disruptions.
   - roles: End Users, IT Support Staff
   - references: https://learn.microsoft.com/defender-office-365/safe-attachments-about#safe-attachments-policy-settings

Need for Policy Review and Adjustment
Organizations will need to review and adjust their Safe Attachments policies, which may lead to temporary lapses in security if not done promptly.
   - roles: Email Administrators, IT Managers
   - references: https://learn.microsoft.com/defender-office-365/safe-attachments-about#safe-attachments-policy-settings

Configutation Options**

XXXXXXX ... paid membership only

Potentional Risks**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft is making a change to its Safe Attachments policy in Microsoft Exchange Online Protection, which is part of Microsoft Defender for Office 365. Imagine you have a security guard at the entrance of your office building. This guard has four options when someone tries to enter with a suspicious package: ignore it (Off), watch and report it without stopping it (Monitor), stop it (Block), or check it and then let it in if it's safe (Dynamic delivery).

Currently, some organizations use the "Monitor" option, where the security guard simply observes and reports on suspicious packages without stopping them. However, Microsoft has decided to retire this "Monitor" option between July and August 2025. This means that if your organization currently uses the "Monitor" option, it will automatically be switched to "Block," where the security guard will stop the package from entering the building.

The "Block" option is like having the security guard prevent any suspicious packages from entering, ensuring the safety of everyone inside. The other options that will remain are "Off," where the guard does nothing, and "Dynamic delivery," where the guard checks the package and only lets it in if it's safe.

If your organization still wants to observe how attachments are handled without blocking them, Microsoft suggests using something called "Evaluation mode." This is like having a trial run where you can see how the security measures would work without fully implementing them.

It's important to review your current settings before this change takes place to ensure your organization's email security policies are aligned with your needs. If you need further guidance, Microsoft provides resources and reports to help you understand and adjust to these changes.