Microsoft Exchange Online Protection (Defender for Office 365): Monitor action in Safe attachments policy will retire

Updated June 4, 2025: We have updated the timeline below. Thank you for your patience.

We will retire the Monitor action in the Safe attachments policy in Microsoft Exchange Online Protection (Microsoft Defender for Office 365) starting early July 2025 (previously late March) and ending by late August 2025 (previously late May).

How this will affect your organization:

A Safe attachments policy provides an additional layer of protection against malicious content (attachments) in emails by analyzing attachment content and behavior in a sandbox environment. This policy provides four actions: Off, Monitor, Block, and Dynamic delivery. We made the Monitor action available for customers who wanted a Safe attachments policy to process attachments, deliver the emails (without blocking malicious attachments), and track what happened with attachments identified as malicious. Customers used reports to see detections from the Monitor action in the policy.

As part of this retirement, if your organization has Safe attachments policies set to the Monitor action, we will automatically change the action in from Monitor to Block. We will not change the policy's recipients, status, or priority. After retirement, the Monitor option will not be available in the Safe Attachments policy page in the Defender security portal or the corresponding Microsoft PowerShell cmdlet.

Before retirement, you can find the Monitor action in Defender > Email & collaboration > Policies & rules > Threat policies > Safe attachments > choose a policy or create a new policy > Edit settings (or Settings if creating a new policy). We will also retire Redirect messages with detected attachments, because this option only supports the Monitor action):

After the retirement, the only actions in the Safe attachments policy will be Off, Block, and Dynamic delivery.

What you need to do to prepare:

Before the retirement, review your Safe attachments policies and take appropriate action if your organization has Safe attachments policies set to the Monitor action. We recommend changing the action from Monitor to Block.

Alternatively, if you still need to run Safe attachment policy in audit mode, we recommend using Evaluation mode. Learn more about Evaluation mode.

You can also review detections by Evaluation mode policies using the Threat Protection Status report.

Learn more: The Safe Attachment policy settings section of Safe Attachments - Microsoft Defender for Office 365 | Microsoft Learn