MDO: Safe Attachments policy: Deprecate policy action ‘Replace’ for malware detections in attachments (Phase 2)

Originally posted by Microsoft Mar 10, 2023 Uncategorized 0 Comments

In Safe Attachment policies, as part of Phase 1 changes for ‘Replace’ action retirement (MC424901 August ’22), the behavior of the ‘Block’ action was applied to the policies configured with ‘Replace’ action.

As part of Phase 2 of the ‘Replace’ action retirement work, the ‘Replace’ action selection will be removed from the Safe Attachment policies (Microsoft 365 Defender portal and cmdlets). As part of this change, any policies still configured with the ‘Replace’ action will be automatically changed to the ‘Block’ action.

When this will happen:

This change will start rolling out from mid-April 2023 and worldwide deployment will be complete by mid-May 2023. For Government clouds, the deployment will start in mid-June 2023 and will be complete by late-June 2023.

How this will affect your organization:

Once this change is rolled out, the ‘Replace’ action will no longer be available in Safe Attachment policies.

What you need to do to prepare:

No action is needed. Any Safe Attachments policies with the ‘Replace’ action will be updated to the ‘Block’ action. 

Please review to learn more:

• Safe Attachments in Microsoft Defender for Office 365
• Safe Attachments policy settings

Message ID: MC525759