Preventing Malicious File Access in Teams, OneDrive, and SharePoint
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. You need to ensure that users are prevented from opening or downloading malicious files from Microsoft Teams, OneDrive, or SharePoint Online. What should you do?
Community Insight
The question tests which Defender for Office 365 feature covers files in collaboration apps rather than email, and the trap is picking an email-focused policy (Anti-malware, Anti-phishing) or a URL-focused control (Safe Links) instead of Safe Attachments.
This MS-102 scenario tests how Microsoft Defender for Office 365 blocks malicious files beyond email, specifically in Microsoft Teams, OneDrive, and SharePoint Online. The correct control is the Safe Attachments global settings, which extend detonation-based file scanning and blocking to those collaboration services.
The most common wrong pick is B, configuring Safe Links global settings, because Safe Links is also a 'global settings' page and also spans Teams/OneDrive/SharePoint — but it protects against malicious URLs and web traffic, not malicious files. Options A and C are email-policy based and do not cover SPO/ODFB/Teams files.
Community Discussion (17 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Safe Attachments in Defender for Office 365 scans and takes action on potentially malicious files not only in email attachments but also in documents stored in SharePoint, OneDrive, and Microsoft Teams. Microsoft documents this protection in the "Safe Attachments in SharePoint, OneDrive, and Microsoft Teams" article, and the configuration flow begins in the Microsoft 365 Defender portal by turning on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams. As the top-voted comment from Nilz76 explains, "When configured, Safe Attachments can scan and take action on potentially malicious files not only in email attachments but also in documents in SharePoint, OneDrive, and Microsoft Teams." The relevant control for this cross-service file protection is exposed on the Safe Attachments Global Settings page, which is why option D is the correct action. Turning on this global setting makes files found to be malicious inaccessible — users are prevented from opening or downloading them, matching the requirement exactly.
Why the Other Options Are Wrong
Option B, Safe Links global settings, is the closest distractor because Safe Links also spans Teams, OneDrive, and SharePoint — but it protects against malicious URLs and time-of-click web traffic, not malicious files; as NrdAlrt noted, "That's malicious web traffic focused. These are malicious files." Options A and C, an Anti-malware policy and an Anti-phishing policy respectively, are Exchange mail flow-style policies that apply to inbound email messages and their attachments; they have no coverage of documents at rest in SharePoint, OneDrive, or Teams, so neither can satisfy a requirement about opening or downloading files from those services. The correct site-level protection is Safe Attachments, not an anti-malware policy scoped to mail.
Community Comment Notes
The community is strongly aligned on D, with Nilz76, andrewtb, moshkoshbgosh, Ozguraydin, Greatone1, MaasZaq, and RahulX all selecting it and citing Microsoft documentation. andrewtb posted the exact configuration path, noting "Use the Microsoft 365 Defender portal to turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams," while moshkoshbgosh linked the "Safe Attachments in SharePoint, OneDrive, and Microsoft Teams" about page. cgmaxmax paraphrased the official description that Safe Attachments protects "from malicious content in email attachments and files in SharePoint, OneDrive, and Teams," and moshkoshbgosh quoted the Safe Attachments Global Settings page wording about protecting the organization from malicious content. The lone dissent came from NrdAlrt's comment, which applies to Safe Links rather than to this file-focused requirement, so the consensus of D is well supported by the vendor documentation.
Official Reference
Exam Strategy
When a question names Teams, OneDrive, or SharePoint plus 'malicious files', immediately think Safe Attachments; when it names malicious links or URLs across those same services, think Safe Links. Confirm whether the requirement is about files at rest versus URLs before choosing a global setting versus a scoped policy.
Frequently Asked Questions
Why is configuring Safe Links global settings wrong for preventing malicious file downloads?
Safe Links protects against malicious URLs and time-of-click web traffic across Teams, OneDrive, and SharePoint, but it does not scan or block the files themselves. File blocking is handled by Safe Attachments.
Can an Anti-malware policy in Defender for Office 365 protect files in SharePoint or OneDrive?
No. Anti-malware policies are mail-flow policies applied to inbound email messages and their attachments; they do not cover documents stored in SharePoint, OneDrive, or Teams.
Related Analysis
Practice All MS-102 Questions
Access 111 questions with complete answers and detailed explanations.
View Full MS-102 Practice Test →