Preventing Malicious File Access in Teams, OneDrive, and SharePoint

MS-102 By islever Editorial Last updated

Implement and manage email and collaboration protection by using Microsoft Defender for Office 365

Short answer

D Configure the Safe Attachments global settings so Defender for Office 365 blocks malicious files in Microsoft Teams, OneDrive, and SharePoint Online.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.
You need to ensure that users are prevented from opening or downloading malicious files from Microsoft Teams, OneDrive, or SharePoint Online.
What should you do?
  1. Create a new Anti-malware policy.
  2. Configure the Safe Links global settings.
  3. Create a new Anti-phishing policy.
  4. Configure the Safe Attachments global settings. Correct Answer

Key Takeaways

The question tests which Defender for Office 365 feature covers files in collaboration apps rather than email, and the trap is picking an email-focused policy (Anti-malware, Anti-phishing) or a URL-focused control (Safe Links) instead of Safe Attachments.

This MS-102 scenario tests how Microsoft Defender for Office 365 blocks malicious files beyond email, specifically in Microsoft Teams, OneDrive, and SharePoint Online. The correct control is the Safe Attachments global settings, which extend detonation-based file scanning and blocking to those collaboration services.

Common mistake: The most common wrong pick is B, configuring Safe Links global settings, because Safe Links is also a 'global settings' page and also spans Teams/OneDrive/SharePoint — but it protects against malicious URLs and web traffic, not malicious files. Options A and C are email-policy based and do not cover SPO/ODFB/Teams files.

Expert Analysis

Why the Answer Is Correct

Safe Attachments in Defender for Office 365 scans and takes action on potentially malicious files not only in email attachments but also in documents stored in SharePoint, OneDrive, and Microsoft Teams. Microsoft documents this protection in the "Safe Attachments in SharePoint, OneDrive, and Microsoft Teams" article, and the configuration flow begins in the Microsoft 365 Defender portal by turning on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams. As the top-voted comment from Nilz76 explains, "When configured, Safe Attachments can scan and take action on potentially malicious files not only in email attachments but also in documents in SharePoint, OneDrive, and Microsoft Teams." The relevant control for this cross-service file protection is exposed on the Safe Attachments Global Settings page, which is why option D is the correct action. Turning on this global setting makes files found to be malicious inaccessible — users are prevented from opening or downloading them, matching the requirement exactly.

Why the Other Options Are Wrong

Option B, Safe Links global settings, is the closest distractor because Safe Links also spans Teams, OneDrive, and SharePoint — but it protects against malicious URLs and time-of-click web traffic, not malicious files; as NrdAlrt noted, "That's malicious web traffic focused. These are malicious files." Options A and C, an Anti-malware policy and an Anti-phishing policy respectively, are Exchange mail flow-style policies that apply to inbound email messages and their attachments; they have no coverage of documents at rest in SharePoint, OneDrive, or Teams, so neither can satisfy a requirement about opening or downloading files from those services. The correct site-level protection is Safe Attachments, not an anti-malware policy scoped to mail.

Community Comment Notes

The community is strongly aligned on D, with Nilz76, andrewtb, moshkoshbgosh, Ozguraydin, Greatone1, MaasZaq, and RahulX all selecting it and citing Microsoft documentation. andrewtb posted the exact configuration path, noting "Use the Microsoft 365 Defender portal to turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams," while moshkoshbgosh linked the "Safe Attachments in SharePoint, OneDrive, and Microsoft Teams" about page. cgmaxmax paraphrased the official description that Safe Attachments protects "from malicious content in email attachments and files in SharePoint, OneDrive, and Teams," and moshkoshbgosh quoted the Safe Attachments Global Settings page wording about protecting the organization from malicious content. The lone dissent came from NrdAlrt's comment, which applies to Safe Links rather than to this file-focused requirement, so the consensus of D is well supported by the vendor documentation.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question names Teams, OneDrive, or SharePoint plus 'malicious files', immediately think Safe Attachments; when it names malicious links or URLs across those same services, think Safe Links. Confirm whether the requirement is about files at rest versus URLs before choosing a global setting versus a scoped policy.

Frequently Asked Questions

Why is configuring Safe Links global settings wrong for preventing malicious file downloads?

Safe Links protects against malicious URLs and time-of-click web traffic across Teams, OneDrive, and SharePoint, but it does not scan or block the files themselves. File blocking is handled by Safe Attachments.

Can an Anti-malware policy in Defender for Office 365 protect files in SharePoint or OneDrive?

No. Anti-malware policies are mail-flow policies applied to inbound email messages and their attachments; they do not cover documents stored in SharePoint, OneDrive, or Teams.

More MS-102 FAQ →

Discussion 17 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 17

  1. Nilz76 👍 17 Answered D
    D. Configure the Safe Attachments global settings. Microsoft Defender for Office 365 includes a feature known as Safe Attachments, which checks to see if email attachments or web downloads are malicious. When configured, Safe Attachments can scan and take action on potentially malicious files not only in email attachments but also in documents in SharePoint, OneDrive, and Microsoft Teams.
  2. cgmaxmax 👍 4
    Safe Attachments - Protect your organization from malicious content in email attachments and files in SharePoint, OneDrive, and Teams.
  3. moshkoshbgosh 👍 3 Answered D
    Safe attachments supports Teams, SharePoint, OneDrive - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about . The following text is taken directly from Safe Attachments Global Settings in the Defender portal... " Global settings Use this page to protect your organization from malicious content in email attachments and files in SharePoint, OneDrive, and Microsoft Teams. Protect files in SharePoint, OneDrive, and Microsoft Teams If a file in any SharePoint, OneDrive, or Microsoft Teams library is identified as malicious, Safe Attachments will prevent users from opening and downloading the file. Learn more Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams
  4. andrewtb 👍 3 Answered D
    Safe Attachments: Step 1: Use the Microsoft 365 Defender portal to turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams (https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-configure?view=o365-worldwide#step-1-use-the-microsoft-365-defender-portal-to-turn-on-safe-attachments-for-sharepoint-onedrive-and-microsoft-teams)
  5. mhmyz 👍 2 Answered D
    https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about?view=o365-worldwide
Show 12 more comments
  1. NrdAlrt 👍 2
    That's malicious web traffic focused. These are malicious files.
  2. Greatone1 👍 2 Answered D
    D is the correct answer
  3. Ozguraydin 👍 2 Answered D
    Answer is correct.
  4. Dtriminio 👍 1 Answered B
    In organizations with Microsoft Defender for Office 365, Safe Links scanning protects your organization from malicious links, including QR codes, that are used in phishing and other attacks. Specifically, Safe Links provides URL scanning and rewriting of inbound email messages during mail flow, and time-of-click verification of URLs and links in email messages, Teams, and supported Office 365 apps. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide
  5. mikl 👍 1 Answered D
    To ensure that users are prevented from opening or downloading malicious files from Microsoft Teams, OneDrive, or SharePoint Online, you should: D. Configure the Safe Attachments global settings. Safe Attachments for SharePoint, OneDrive, and Microsoft Teams provides an additional layer of protection against malware by scanning files in a virtual environment. It can be configured to prevent users from opening or downloading malicious files1.
  6. Tomtom11 👍 1
    Anti-malware policy Anti-malware policies allow you to configure how Microsoft 365 protects your organization from malware transmitted through email messages. By default, existing policies will already provide adequate protection against threats of this type. If necessary, you can create a custom anti-malware policy by performing the following steps:
  7. alecrobertburns 👍 1 Answered D
    https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/step-by-step-guides/utilize-microsoft-defender-for-office-365-in-sharepoint-online?view=o365-worldwide#stop-infected-file-downloads-from-sharepoint-online
  8. osxzvkwpfcfxobqjby 👍 1 Answered B
    Safe attachments is only for mail so the answer is B https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-policies-configure?view=o365-worldwide
  9. RAG 👍 1 Answered D
    https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-configure?view=o365-worldwide
  10. RahulX 👍 1 Answered D
    D. Configure the Safe Attachments global settings
  11. MaasZaq 👍 1 Answered D
    Answer seems correct
  12. LakesWizard 👍 1 Answered D
    D - Safe Attachments

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which passwordless method works on Windows, Android, and iOS?

S-grade

How Do You Monitor Mailbox Activities in Defender for Cloud Apps?

S-grade

Which components configure a Defender for Cloud Apps log collector?

S-grade

How to Configure a Custom Phishing Link in Attack Simulation Training?

S-grade

Practice All MS-102 Questions

Access 111 questions with complete answers and detailed explanations.

View Full MS-102 Practice Test →

← Back to MS-102 Study Guide