Safe Documents is Generally Available

Published Jun 22 2020 09:00 AM 21.9K Views

Building on secure productivity, today we announce the general availability of Safe Documents*, a new Microsoft 365 Apps feature that keeps enterprise users safe by verifying untrusted files on their behalf. 


Safe Documents is a new feature that improves the existing Protected View experience. Although Protected View helps secure documents originating outside the organization, people too often exit the protection sandbox without considering if the document is safe – leaving their organizations vulnerable. To improve this trust promotion experience for Microsoft 365 Apps, Safe Documents takes away the guesswork by automatically verifying the document against the latest known risks and threat profiles before allowing users to leave the Protected View container. 


Keeping Users Safe:


Safe Documents leverages the power of the Microsoft Intelligent Security Graph and brings it to the desktop. When an admin enables Safe Documents for their tenant, untrusted files that open in Protected View go through an additional flow where the document is uploaded and scanned by Microsoft Defender ATP. Learn more about how Microsoft is handling user data here.




While a scan is in progress, Safe Documents will prevent users from exiting the Protected View container. Users are still able to access and read the document during this process but will be unable to make any edits until the scan has completed.



Once the file has been successfully scanned, users will be able to leave the Protected View container with confidence that their file is safe.




In case of a malicious file (above), users will be blocked from leaving the Protected View container. Admins can configure whether users can bypass and ‘Enable Editing’ for malicious scenarios in the Admin portal. Learn more about the user experience in this article.


Analytics for Admins:


In addition to providing these protections to enterprise users, we have also integrated features from Microsoft Defender Advanced Threat Protection – where admins can use the powerful Advanced Hunting feature, based on the Kusto query language, to get additional details in their tenants by using the DeviceEvents table and filtering for ActionType ‘SafeDocFileScan’.




Details to get started with Advanced Hunting are available here. As we continue to receive feedback from customers, we will plan for additional functionality as we integrate with other features in the MDATP toolkit to provide greater visibility into these detections.


Enabling Safe Documents:


This feature is off by default and needs to be enabled by a Security Administrator. To turn on Safe Documents, the admin should navigate to the Security & Compliance center and go to Threat Management > Policy > ATP Safe Attachments where there will be settings to ‘Turn on Safe Documents for Office clients’ and another option to allow users to bypass protections if a file is malicious.




Thank you for those who joined us in the preview. We look forward to more of you enabling this protection and hearing feedback on how we can improve and evolve this solution.


* The Safe Documents feature is only available with a ‘Microsoft 365 E5’ or Microsoft 365 E5 Security’ license for Commercial and Education customers on Windows clients.


Occasional Visitor


Frequent Contributor

Hey @Kenny Shi, appreciate the write up.  


If this is an E5 feature, but enabled at the tenant level, are users on <E5 licenses automatically out of scope (they do not get Safe Documents) or will they technically be able to use it, but not be license compliant?  If the latter, it's hard to recommend anyone enables this yet.




Thanks for your interest @Ru! Office clients will be enforcing these license checks, so even if the feature is enabled for the entire tenant only the correctly licensed E5 users will be able to get the functionality. 

Frequent Contributor

@Kenny Shi Microsoft
‎2020-07-02 06:51 PM


Thanks for your interest @Ruairidh Campbell! Office clients will be enforcing these license checks, so even if the feature is enabled for the entire tenant only the correctly licensed E5 users will be able to get the functionality. 

That's awesome, makes things a lot simpler than managing with scopes as you do in other parts of O365 ATP.  Thanks!

Occasional Contributor

We enabled this feature but had to quickly turn it off due to some very large documents taking 10-15 minutes to open. Will there be some configuration options in the future to limit or reduce the impact of this feature but still benefit from its protection abilities?

Where can we learn or follow more about how this feature will develop in the future?

Thanks very much,


Thanks for reaching out @Brad Rush! We have a document upload limit of 60 MB currently but these scans should not be taking that long. I've reached out privately to get additional details to help us investigate your issue. Appreciate your patience!

New Contributor

Does it supports EOL win7 clients ?

New Contributor

@Kenny Shi i'm having same issue with Brad Rush. Is there any recommendation or any specific settings i can look at? the spreadsheet that are just about 2mb takes almost a minute to open. Thank you

New Contributor

Can you clarify availability for Government GCC Tenants, IE Can M365 G5 subscriptions holders use SafeDocs apps features.  If not, What does roadmap look like for GA in GCC.*%2C%20a%20new%20Microsoft%20365%20Apps%20feature%20that%20keeps%20enterp*%20The%20Safe%20Documents%20feature%20is%20only%20available%20with%20a%20%E2%80%98Microsoft%20365%20E5%E2%80%99%20or%20%3CSTRONG%3E%E2%80%98%3C%2FSTRONG%3EMicrosoft%20365%20E5%20Security%E2%80%99%20license%20for%!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1503166%22%!%20Office%20clients%20will%20be%20enforcing%20these%20license%20checks%2C%20so%20even%20if%20the%20feature%20is%20enabled%20for%20the%20entire%20tenant%20only%20the%20correctly%20licensed%20E5%20users%20will%20be%20able%20to%20get%20the%20functionality.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-s!%20Office%20clients%20will%20be%20enforcing%20these%20license%20checks%2C%20so%20even%20if%20the%20feature%20is%20enabled%20for%20the%20entire%20tenant%20only%20the%20correctly%20licensed%20E5%20users%20will%20be%20able%20to%20get%20the%20functionality.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CP%3EThat's%20awesome%2C%20makes%20things%20a%20lot%20simpler%20than%20managing%20with%20scopes%20as%20you%20do%20in%20other%20parts%20of%20O365%20ATP.%26nbsp%3B%20Thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1539983%22%20slang%3D%22en-US%22%3ERe%3A%20Safe%20Documents%20is%20Generally%20Available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1539983%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20enabled%20this%20feature%20but%20had%20to%20quickly%20turn%20it%20off%20due%20to%20some%20very%20large%20documents%20taking%2010-15%20minutes%20to%20open.%20Will%20there%20be%20some%20configuration%20options%20in%20the%20future%20to%20limit%20or%20reduce%20the%20impact%20of%20this%20feature%20but%20still%20benefit%20from%20its%20protection%20abilities%3F%3C%2FP%3E%3CP%3EWhere%20can%20we%20learn%20or%20follow%20more%20about%20how%20this%20feature%20will%20develop%20in%20the%20future%3F%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EThanks%20very%20much%2C%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1542603%22!%20We%20have%20a%20document%20upload%20limit%20of%2060%20MB%20currently%20but%20these%20scans%20should%20not%20be%20taking%20that%20long.%20I've%20reached%20out%20privately%20to%20get%20additional%20details%20to%20help%20us%20investigate%20your%20issue.%20Appreciate%20your%20patience!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1713147%22%20slang%3D%22en-US%22%3ERe%3A%20Safe%20Documents%20is%20Generally%20Available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1713147%22%20slang%3D%22en-US%22%3E%3CP%3EDoes%20it%20supports%20EOL%20win7%20clients%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎May 06 2021 12:47 PM
Updated by: