Commands › Exchange Online

New-SafeAttachmentPolicy

Exchange Online ExchangeOnlineManagement New-*

Create safe attachment policies in your cloud-based organization.

Quick start script

# New-SafeAttachmentPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-SafeAttachmentPolicy
$before | Format-List

# 3. Make the change (dry run first)
New-SafeAttachmentPolicy -Name <String> -WhatIf
New-SafeAttachmentPolicy -Name <String>

# 4. Verify and diff
$after = Get-SafeAttachmentPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-SafeAttachmentPolicy [-Name] <String>
 [-Action <SafeAttachmentAction>]
 [-AdminDisplayName <String>]
 [-Confirm]
 [-Enable <Boolean>]
 [-MakeBuiltInProtection]
 [-QuarantineTag <String>]
 [-RecommendedPolicyType <RecommendedPolicyType>]
 [-Redirect <Boolean>]
 [-RedirectAddress <SmtpAddress>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (11)

Parameter	Type	Required	What it controls
-Name	String	yes	The Name parameter specifies a unique name for the safe attachment policy. If the value contains spaces, enclose the value in quotation marks (").
-Action	SafeAttachmentAction		The Action parameter specifies the action for the safe attachment policy. Valid values are:
-AdminDisplayName	String		The AdminDisplayName parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks (").
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Enable	Boolean		The Enable parameter works with the Action parameter to specify the action for the safe attachment policy. Valid values are:
-MakeBuiltInProtection	SwitchParameter		The MakeBuiltInProtection switch is used for Built-in protection policy creation as part of [Preset security policies](https://learn.microsoft.com/defender-office-365/preset-security-policies). Don't use this switch yourself.
-QuarantineTag	String		The QuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as malware by Safe Attachments. You can use any value that uniquely identifies the quarantine policy. For example:
-RecommendedPolicyType	RecommendedPolicyType		The RecommendedPolicyType parameter is used for Standard and Strict policy creation as part of [Preset security policies](https://learn.microsoft.com/defender-office-365/preset-security-policies). Don't use this...
-Redirect	Boolean		The Redirect parameter specifies whether to deliver messages to an alternate email address if malware is detected in an attachment. Valid values are:
-RedirectAddress	SmtpAddress		The RedirectAddress parameter specifies the destination email address to deliver messages if malware is detected in an attachment.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.