Description:
Verifies that files which Microsoft Defender for Office 365 has detected as infected are blocked from being downloaded from SharePoint, OneDrive and Microsoft Teams. By default, SharePoint Online allows these files to be downloaded.
Why:
By default, SharePoint online allows files that Defender for Office 365 has detected as infected to be downloaded. Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams protects your organization from inadvertently sharing malicious files. When an infected file is detected that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization's security team.
Configured: This setting is in place.
Not Configured: This setting is not in place.
Scoring: Contributes up to 1 point to the Posture Recommendations score.
Category: General
Microsoft Licensing: M365 Defender
Secure Score Impact: Not verified. No Microsoft Secure Score control could be confirmed for this setting from published sources. See the note in README.md before publishing this field.
Remediation in Augmentt: Configure directly in Augmentt (Configure tab)
Compliance Frameworks:
CIS Microsoft 365 Benchmark v6 (Level 2) — 7.3.1
CIS Controls v8 — 10.1
Microsoft documentation: