Anti-malware: common attachments filter on with Reject, zero-hour auto purge on, admin-only quarantine¶
Licence and role
Any Exchange Online plan (EOP).
Why it matters¶
Most malware still arrives as an attachment type no business sends by mail (.exe, .iso, .js and similar). Microsoft's Standard and Strict values turn on the common attachments filter with Reject with NDR, zero-hour auto purge (ZAP) to pull malware out of mailboxes after delivery, and the AdminOnlyAccessPolicy quarantine policy so users cannot release malware themselves.
Steps¶
- Defender portal > Threat policies > Anti-malware > Default (Default) > Edit protection settings: tick Enable the common attachments filter, choose Reject the message with a non-delivery receipt, keep the default file types and add any others you never accept.
- Tick Enable zero-hour auto purge for malware and set Quarantine policy to AdminOnlyAccessPolicy.
- If a business process really needs a blocked file type (for example .iso from one vendor), use a shared upload location instead of an exception in the policy.
Impact on users¶
Senders of blocked attachment types get an NDR. Users cannot release quarantined malware; requests go to the admin.
Rollback¶
Untick the filter or remove a single file type from the list. ZAP can be turned off per policy.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: ExchangeOnlineManagement module (3.x). DNS checks use Resolve-DnsName (Windows PowerShell 5.1 or PowerShell 7 on Windows).
Connect first:
Connect-ExchangeOnline
Connect-IPPSSession # only for the alert policy check (EX20)
Role: Global Reader, Security Reader or View-Only Organization Management is enough for these reads.
Get-MalwareFilterPolicy | ForEach-Object { "$($_.Name) | EnableFileFilter: $($_.EnableFileFilter) | FileTypeAction: $($_.FileTypeAction) | ZapEnabled: $($_.ZapEnabled) | QuarantineTag: $($_.QuarantineTag) | file types: $(@($_.FileTypes).Count)" }
How to verify¶
Every anti-malware policy shows EnableFileFilter True, FileTypeAction Reject, ZapEnabled True and QuarantineTag AdminOnlyAccessPolicy.
Sources¶
This control is in the Exchange Online Protection Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 20 controls.