How protection lands in Teams
- Safe Links in Teams: URLs in chats/channels are checked AT CLICK TIME against detonation/reputation (Teams links aren't rewritten like classic mail rewriting; the client consults the service on click). Malicious -> block page; the click is logged either way. Requires MDO Plan (1/2 per current packaging) and the Safe Links policy's Teams checkbox actually ON for the recipients.
- Safe Attachments for SPO/OneDrive/Teams: files landing in the backing stores are detonated asynchronously; verdict-bad files get locked (blocked for open/download) rather than removed — users see the block, admins see the detection.
- ZAP for Teams (zero-hour auto purge): retro-blocks messages weaponised AFTER delivery — the link that turned malicious an hour later gets neutralised in place.
The edges (know them cold)
| Edge | Reality |
|---|---|
| Policy scoping | Protection follows RECIPIENT policy membership — externals/guests in your tenant ride your policies; your users in OTHER tenants' shared channels ride the host's |
| File coverage | Detonation is store-side: files pasted as links to EXTERNAL stores (personal Dropbox et al.) are Safe Links territory, not Safe Attachments |
| Encrypted/passworded archives | Undetonatable — verdicts fall back to reputation/heuristics |
| Click-through | Policy can allow users to proceed past warnings — audit whether yours does; 'protected' with click-through ON is a softer claim |
What to watch (proofs)
- Policy truth:
Get-SafeLinksPolicy | fl EnableSafeLinksForTeamsandGet-AtpPolicyForO365 | fl EnableATPForSPOTeamsODB(EXO PowerShell — inside serv365's scanned Purview/EXO surface family) — the two switches that make all of this real; both default-off histories mean brownfield tenants often THINK they're covered. - Detections happening: Threat Explorer / advanced hunting filtered to Teams as the workload — click events, blocks, ZAP actions; zero-forever here usually means the switches above, not a clean org.
- The block experience: send a test EICAR-style/known-test URL in a pilot chat — the block page + the corresponding alert is the end-to-end proof.
- Locked files: an SPO/OneDrive detection leaves the file visibly blocked — the audit log entry + user-visible state confirm store-side detonation operating.