--- title: Defender for Email Attachment Scanning Policy Modification description: This guide will provide background information on modifying an existing safe attachment threat policy. --- [Skip to content](https://knowledge.sittadel.com/defender-for-email-attachment-scanning-policy-modification#main-content) [![Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent copy](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png?width=55&height=55&name=Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png)](https://sittadel.com/) - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) Open main navigation Close main navigation - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) - [Get Sittadel](https://sittadel.com/start/) [Get Sittadel](https://sittadel.com/start/) Find answers to your security questions. - There are no suggestions because the search field is empty. 1. [Sittadel Knowledge Base](https://knowledge.sittadel.com/?hsLang=en) 2. [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en) 3. [Defender](https://knowledge.sittadel.com/azure-portals?hsLang=en#defender) # Defender for Email Attachment Scanning Policy Modification ## This guide will provide background information on modifying an existing safe attachment threat policy. ### **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Jan-19-2024-04-04-16-2156-PM.png?width=125&height=133&name=image-png-Jan-19-2024-04-04-16-2156-PM.png)Role Requirements** Procedure Scope: **Administrators** Required Group Membership: **Admin.Security** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Jan-19-2024-04-29-09-3760-PM.png?width=670&height=5&name=image-png-Jan-19-2024-04-29-09-3760-PM.png)** **Modifying a Safe Attachments Threat Policy** 1. Navigate to the [Safe Attachments – Microsoft Defender](https://security.microsoft.com/safeattachmentv2) portal, locate and select the policy you wish to alter. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Dec-02-2024-03-44-29-9968-PM.png?width=670&height=355&name=image-png-Dec-02-2024-03-44-29-9968-PM.png)** 2. Upon opening the policy, all the information of the policy will be displayed. Three points of interest will be available to **Edit**. You can modify the sections as needed. 1. **Description:** Adjusts non-functional items of the rule, such as the **Name** or **Description** of the rule. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Dec-02-2024-03-44-25-2515-PM.png?width=670&height=356&name=image-png-Dec-02-2024-03-44-25-2515-PM.png) 2. **Users and Domains:** Specifies which **Users**, **Groups**, or **Owned Domains** that will be included or excluded from policy enforcement. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Dec-02-2024-03-44-19-2423-PM.png?width=670&height=356&name=image-png-Dec-02-2024-03-44-19-2423-PM.png) 3. **Settings:** Specifies the filters that will be applied to emails for a compliance match as well as how messages will be handled when they fail this threat policy check. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Dec-02-2024-03-41-23-8117-PM.png?width=670&height=354&name=image-png-Dec-02-2024-03-41-23-8117-PM.png) 3. Regardless of which section is selected to be **Edited**, the same redirect to the **Edit** page will be displayed. This page will display the selected sections current configuration and will allow you to make the necessary adjustments (additions, removals, editing, etc.) Once the necessary adjustments have been configured for the desired section select **Save**. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Dec-02-2024-03-38-52-8518-PM.png?width=670&height=356&name=image-png-Dec-02-2024-03-38-52-8518-PM.png) 4. You will be redirected back to the policy overview page, if all the necessary adjustments look correct, select **Close** to finalize modification process. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Dec-02-2024-03-35-43-6820-PM.png?width=670&height=356&name=image-png-Dec-02-2024-03-35-43-6820-PM.png) ### Need Assistance? Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? [Inquire](https://sittadel.com/start/) about arranging a consultation to explore optimizing your Azure environment for painless management. - [UserOps](https://knowledge.sittadel.com/userops?hsLang=en#main-content) - [Access & Permissions](https://knowledge.sittadel.com/userops?hsLang=en#access-permissions) - [Account](https://knowledge.sittadel.com/userops?hsLang=en#account) - [Devices](https://knowledge.sittadel.com/userops?hsLang=en#devices) - [Document Sharing](https://knowledge.sittadel.com/userops?hsLang=en#document-sharing) - [Email](https://knowledge.sittadel.com/userops?hsLang=en#email) - [Requests](https://knowledge.sittadel.com/userops?hsLang=en#requests) - [Troubleshoot](https://knowledge.sittadel.com/userops?hsLang=en#troubleshoot) - [TechOps](https://knowledge.sittadel.com/techops?hsLang=en#main-content) - [Tenant Foundations](https://knowledge.sittadel.com/techops?hsLang=en#tenant-foundations) - [Collaboration Security](https://knowledge.sittadel.com/techops?hsLang=en#collaboration-security) - [Email Security](https://knowledge.sittadel.com/techops?hsLang=en#email-security) - [Device Security](https://knowledge.sittadel.com/techops?hsLang=en#device-security) - [Identity Security](https://knowledge.sittadel.com/techops?hsLang=en#identity-security) - [SecOps](https://knowledge.sittadel.com/secops?hsLang=en#main-content) - [Email SOC](https://knowledge.sittadel.com/secops?hsLang=en#email-soc) - [Identity SOC](https://knowledge.sittadel.com/secops?hsLang=en#identity-soc) - [Tenant SOC](https://knowledge.sittadel.com/secops?hsLang=en#tenant-soc) - [Device SOC](https://knowledge.sittadel.com/secops?hsLang=en#device-soc) - [Deploy Intune](https://knowledge.sittadel.com/deploy-intune?hsLang=en) - [Deploy MDE](https://knowledge.sittadel.com/deploy-mde?hsLang=en#main-content) - [Overview](https://knowledge.sittadel.com/deploy-mde?hsLang=en#overview) - [Intune Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#intune-deployment) - [Hands-On Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#hands-on-deployment) - [Azure Arc Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#azure-arc-deployment) - [RMM Tool Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#rmm-tool-deployment) - [MECM/SCCM Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#mecm-sccm-deployment) - [GPO Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#gpo-deployment) - [Deploy Services](https://knowledge.sittadel.com/deploy-services?hsLang=en#main-content) - [Cloud Enclave](https://knowledge.sittadel.com/deploy-services?hsLang=en#cloud-enclave) - [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en#main-content) - [Entra ID](https://knowledge.sittadel.com/azure-portals?hsLang=en#entra-id) - [Intune](https://knowledge.sittadel.com/azure-portals?hsLang=en#intune) - [Defender](https://knowledge.sittadel.com/azure-portals?hsLang=en#defender) - [Purview](https://knowledge.sittadel.com/azure-portals?hsLang=en#purview) - [SharePoint Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#sharepoint-admin-center) - [Teams Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#teams-admin-center) - [Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#admin-center) - [Exchange Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#exchange-admin-center) [![](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel_LogoH_Color_BlackText.png?width=186&height=55&name=Sittadel_LogoH_Color_BlackText.png)](https://Sittadel.com) Security for Humans. Copyright © 2026, Sittadel