Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor detecting and blocking malicious files stored in SharePoint, Microsoft Defender for Office 365 Safe Attachments is the closer fit. Defender for Cloud Apps addresses a different layer: risky cloud activity, account and sharing patterns, and file-governance actions. They can complement each other, but they are not interchangeable—and Defender for Cloud Apps file policies are scheduled to retire on January 6, 2027.
How the products differ for SharePoint
| Decision point | Defender for Office 365 | Defender for Cloud Apps |
|---|---|---|
| Primary role | Safe Attachments analyzes potentially malicious files in SharePoint, OneDrive, and Teams, then locks files identified as malicious. | Monitors cloud activity and sharing, helps investigate account or insider risks, and can apply governance actions to cloud files. |
| Examples of signals | Microsoft 365 virus-detection scanning followed by file detonation; asynchronous analysis informed by sharing and guest activity, heuristics, and threat signals. | Unusual file deletion, sharing, or downloads; suspicious IP activity; malware and ransomware alerts. |
| Example response | Lock a detected file; surface detections in Defender reports and Explorer; administrators can access the file in quarantine. | For SharePoint, make a file or folder private, quarantine it, or remove external collaborators. |
| Key limitation | Not every stored file is scanned, and users may still download a detected file unless tenant settings block downloads. | Microsoft says file policies retire January 6, 2027; plan file-based data protection around Microsoft Purview DLP or auto-labeling. |
What Defender for Office 365 does with SharePoint files
Safe Attachments for SharePoint, OneDrive, and Microsoft Teams adds protection against harmful files. Microsoft says files first pass through the common Microsoft 365 virus-detection engine; Safe Attachments can then open selected files in a virtual environment for detonation. When a file is identified as malicious, the service locks it through integration with the file stores. Detections appear in Defender reports and Explorer, and administrators can access the file in quarantine. See Microsoft’s Safe Attachments overview.
As an Amazon Associate I earn from qualifying purchases.
This is asynchronous analysis, not a full scan of every file in every library. Microsoft describes the service as using sharing and guest-activity events, heuristics, and threat signals to identify files for analysis. The overview was last updated May 8, 2026.
Recommended Free Tools
What Defender for Cloud Apps adds
Defender for Cloud Apps is oriented toward cloud threats and activity: compromised accounts, malicious insiders, data leakage, risky sharing, and investigation based on audit activity. Its anomaly and activity templates include suspicious IPs and unusual file deletion, sharing, or multiple downloads, as well as malware and ransomware signals.
For SharePoint, governance actions can include making files or folders private, placing them in administrator or user quarantine, and removing external collaborators. Microsoft also documents file-policy templates for scenarios such as sharing to unauthorized or personal email domains and files containing PII, PCI, or PHI. However, Microsoft states that Defender for Cloud Apps file policies retire January 6, 2027, and directs customers to Microsoft Purview DLP or auto-labeling policies for continuing file-based data protection. Read Microsoft’s Defender for Cloud Apps guidance.
Choose by the risk you need to detect
Malicious file in a SharePoint library
Start with Defender for Office 365 Safe Attachments. It is the product in this comparison that specifically analyzes files and locks those it identifies as malicious. Do not interpret that as a guarantee that every existing file is scanned immediately.
Unusual downloads, sharing, or account behavior
Use Defender for Cloud Apps for activity and behavior signals such as unusual downloads, risky sharing patterns, and suspicious logons. Those controls complement file-level malware detection; they answer a different question from whether a particular stored file is malicious.
Long-term controls for sensitive file content
For file-based data protection, account for the January 6, 2027 retirement of Defender for Cloud Apps file policies. Microsoft points to Purview DLP or auto-labeling as the ongoing route for those needs rather than treating the retiring policies as a durable foundation.
Configure Safe Attachments and control downloads
Microsoft documents two ways to enable Safe Attachments protection for SharePoint, OneDrive, and Teams: the Defender portal’s global settings or Exchange Online PowerShell. Configuration requires appropriate administrative permissions, and Microsoft says changes may take up to 30 minutes to take effect. Consult Microsoft’s configuration steps for the required roles and current portal labels.
- In the Defender portal, open the global settings for Safe Attachments and enable protection for SharePoint, OneDrive, and Teams, following Microsoft’s current configuration instructions.
- Alternatively, in Exchange Online PowerShell, run
Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true. - Allow up to 30 minutes for the setting to take effect, then create an alert policy for detected files as Microsoft recommends.
When a malicious file is detected, SharePoint blocks opening, moving, copying, or sharing it. By default, deletion and downloading remain possible. To block downloads tenant-wide, an administrator can run this SharePoint Online PowerShell command:
Set-SPOTenant -DisallowInfectedFileDownload $true
Microsoft says this setting applies to users and administrators; deletion remains possible. A visual blocked-file indicator requires sites to use the Modern SharePoint experience. These controls are documented in the Safe Attachments configuration guidance.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Prerequisites and licensing
Defender for Office 365
Microsoft’s service description lists SharePoint, OneDrive, and Teams protection under both Defender for Office 365 Plan 1 and Plan 2. Plan 1 inclusion in Office 365 E3 and Microsoft 365 E3 is effective July 1, 2026. Plan 2 adds capabilities including advanced threat hunting, automation, and investigation; the feature table lists Explorer and automated investigation and response in Plan 2, while Plan 1 has real-time detections. Verify the tenant subscription and service-plan assignment rather than assuming an entitlement from a product-family name. See the Microsoft Defender for Office 365 service description.
Defender for Cloud Apps
Microsoft says connecting Microsoft 365 requires at least one assigned Microsoft 365 license. File monitoring requires an appropriate Entra administrator role, such as Application Administrator or Cloud Application Administrator. Microsoft 365 activity monitoring requires Purview auditing to be enabled; see the Microsoft integration guidance.
Keep Safe Links separate from file scanning
Safe Links checks URLs when users click them in supported Office apps. Links to downloadable files are checked only when the applicable Safe Links policy enables real-time URL scanning for suspicious links and links to files. That click-time URL protection is distinct from Safe Attachments’ analysis and locking of SharePoint files. See Microsoft’s Safe Links overview.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
