Challenge: Allow DOCM attachments to be sent to specific external recipients while preventing DOCM attachments inbound to internal recipients.
I hate DOCM - there I said it - I get why some organizations use it but there are better ways and today the risk of a scrupulous payload is too high - Rant over
The client I have only subscribes to EOP. The default Malware policy contains '.docm' so all docm attachments are stopped. The client has a vendor that submits docm's (vendors choice not clients) via an application. The client's users at times must send that docm back to the vendor for whatever reason (edits changes etc). The client uses email to do this. When the client sends the email (outbound) the DOCM is stripped and quarantined by EOP.
I have created new Malware policies to test with for days trying to allow DOCM attachments to only specific recipients but nothing works. I have been specific with 'user@domain.com' and have used wildcards - ' *@domain.com' but in the end the attachments are always stripped. I have had MS support on the phone and the support person tested in the same way I did and he too could not get EOP to allow an outbound email with the docm to go to a specific address. It is always stripped.
I was surprised to find that a single policy (default) handles both inbound and outbound. I expected to be able to be more granular but in the end the only thing that worked was to remove the '.docm' reference in the default policy. This allowed anything with a 'docm' attachment to get out BUT of course it can get in too.
Am I missing something here?
Thanks,
-R-
