Does M365 Defender & EOP has capability to detect password protected files to during the email delivery and ZAP process of the email in user mailbox? If yes how we can configure to stop such emails and put them into quarantine and stop the email delivery

Vinod Survase 4,716

Does M365 Defender & EOP has capability to detect password protected files to during the email delivery and ZAP process of the email in user mailbox? If yes how we can configure to stop such emails and put them into quarantine and stop the email delivery to end users?

Yuki Sun-MSFT 40,931 Reputation points

2023-12-15T03:08:17.2866667+00:00

Hi @Vinod Survase ，

Just checking in to see how things are going with this thread. If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, feel free to post back in the comments.

1 answer

Yuki Sun-MSFT 40,931 Reputation points

2023-12-11T03:04:36.4566667+00:00

Hi @Vinod Survase ，

Does M365 Defender & EOP has capability to detect password protected files to during the email delivery and ZAP process of the email in user mailbox?

No. Based on my research, currently M365 Defender & EOP is not capable of detecting or scanning password protected files.

However, you can create a mail flow rules to take actions against mails include password protected attachments:

I tested in my lab by setting up the aforementioned transport rule and then sent a mail which contained a password protect Excel workbook, the mail can be stopped and put into quarantine:

Additionally, below is a link discussing a similar topic for your reference:
Safe attachments and encrypted or password protected attachments

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Vinod Survase 4,716 Reputation points

2023-12-11T06:59:27.9233333+00:00

Hi Yuki Sun-MSFT

Thanks for your answer on this. I will try this solution and check if that works for us.

Vinod Survase 4,716 Reputation points

2023-12-11T14:43:52.3633333+00:00

Hi Yuki Sun-MSFT

I have tested this and its working as expected but I have another follow-up question on this is that if we deploy this Transport rule to quarantine false or parked domains emails like phishing or spam and unwanted emails then how we would filter and allow the legit email domains to send out such files like .PDF, Docs, excel and other password protected files to users mailbox without putting them into Quarantine?

I also tested by adding the domain in the Except option in the Transport rule but there should be a way which is going to check the domain legitimacy and basis on that may be we should have an option to allow that file to be sent or delivered to users mailbox.

Yuki Sun-MSFT 40,931 Reputation points

2023-12-12T02:55:20.28+00:00

Hi @Vinod Survase ，

Legit email domains should be able to pass SPF so you can add the expect option similar like below to exclude password protected attachments from legit domains:

Message header name: Authentication-Results

words or phrase included: spf=pass

For more information about how SPF works, you can read more via How Microsoft 365 uses Sender Policy Framework (SPF) to prevent spoofing.

Vinod Survase 4,716 Reputation points

2023-12-13T08:30:28.9133333+00:00

Hi Yuki Sun-MSFT

Thanks for your answer on this. Let me test this and see if it works as expected. What else would you recommend on this other than SPF=pass for legit domain to deliver the emails with such files?

Yuki Sun-MSFT 40,931 Reputation points

2023-12-13T08:50:43.4533333+00:00

Hi @Vinod Survase ，

There's not much I can offer aside from using headers related to SPF results. In addition to the header name mentioned above, you can also try using header "Received-SPF":
Sign in to comment

Share via

Does M365 Defender & EOP has capability to detect password protected files to during the email delivery and ZAP process of the email in user mailbox? If yes how we can configure to stop such emails and put them into quarantine and stop the email delivery

1 answer