feat(m365): add defender_safe_attachments_policy_enabled security check #9833

andoniaf · 2026-01-20T09:56:01Z

Context

Adds a new security check defender_safe_attachments_policy_enabled for the m365 provider.

Description

This PR adds a new security check for m365:

Check: defender_safe_attachments_policy_enabled
Implementation: New check that detects security misconfigurations
Tests: Unit tests covering pass, fail, and no-resources scenarios

Steps to review

Review the check implementation at prowler/providers/m365/services/defender/defender_safe_attachments_policy_enabled/
Review the metadata file for correct severity, remediation, and compliance mappings
Run the check tests: poetry run pytest tests/providers/m365/services/defender/defender_safe_attachments_policy_enabled/ -v
Optionally run the check against a test environment

Checklist

Community Checklist

This feature/issue is listed in here or roadmap.prowler.com
Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

Review if the code is being covered by tests.
Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
Review if backport is needed.
Review if is needed to change the Readme.md
Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

Are there new checks included in this PR? Yes
- If so, do we need to update permissions for the provider? Please review this carefully.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Add new security check defender_safe_attachments_policy_enabled for m365 provider. Includes check implementation, metadata, and unit tests.

github-actions · 2026-01-20T09:56:23Z

✅ All necessary CHANGELOG.md files have been updated.

github-actions · 2026-01-20T09:56:25Z

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

codecov · 2026-01-20T09:59:25Z

Codecov Report

❌ Patch coverage is 79.72973% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.41%. Comparing base (31b53f0) to head (d2aa0e9).
⚠️ Report is 1 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (31b53f0) and HEAD (d2aa0e9). Click for more details.

HEAD has 4 uploads less than BASE

Flag BASE (31b53f0) HEAD (d2aa0e9)

prowler-py3.12-azure 1 0

prowler-py3.9-azure 1 0

prowler-py3.10-azure 1 0

prowler-py3.11-azure 1 0

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #9833       +/-   ##
===========================================
- Coverage   86.60%   76.41%   -10.19%     
===========================================
  Files         222      177       -45     
  Lines        5645     9554     +3909     
===========================================
+ Hits         4889     7301     +2412     
- Misses        756     2253     +1497

Flag	Coverage Δ
prowler-py3.10-azure	`?`
prowler-py3.10-lib	`76.41% <79.72%> (?)`
prowler-py3.10-m365	`88.65% <82.60%> (?)`
prowler-py3.11-azure	`?`
prowler-py3.11-lib	`76.35% <79.72%> (?)`
prowler-py3.11-m365	`88.49% <82.60%> (?)`
prowler-py3.12-azure	`?`
prowler-py3.12-lib	`76.35% <79.72%> (?)`
prowler-py3.12-m365	`88.49% <82.60%> (?)`
prowler-py3.9-azure	`?`
prowler-py3.9-lib	`76.35% <79.72%> (?)`
prowler-py3.9-m365	`88.49% <82.60%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	`76.41% <79.72%> (-10.19%)`	⬇️
api	`∅ <ø> (∅)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-01-20T10:04:45Z

🔒 Container Security Scan

Image: prowler:ebad0b1
Last scan: 2026-01-23 13:48:25 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	3
Total	3

3 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

Review the detailed scan results
Update affected packages to patched versions
Consider using a different base image if updates are unavailable

📋 Resources:

Download full report (see artifacts)
View in Security tab
Scanned with Trivy

When Microsoft Defender for Office 365 licensing is not available, PowerShell cmdlets like Get-SafeAttachmentPolicy fail with "not recognized as a name of a cmdlet" errors. This change: - Detects cmdlet not found errors in the PowerShell layer - Logs a clear WARNING instead of ERROR with licensing guidance - Allows execution to continue gracefully, skipping affected checks

Test folders should not contain __init__.py files. Only check implementation folders require them for proper module loading.

When no Safe Attachments policies are found, the check now returns a FAIL finding instead of no findings. This aligns with Maester/CIS expectations that absence of required security features indicates non-compliance.

HugoPBrito · 2026-01-22T14:22:50Z

Please also map the check in the corresponding compliances.

…iance Map the new defender_safe_attachments_policy_enabled check to: - CIS 4.0 M365 requirement 2.1.4 - CIS 6.0 M365 requirement 2.1.4

…fender-safe-attachments-policy-enabled

Move defender_safe_attachments_policy_enabled entry from v5.17.0 (already released) to v5.18.0 unreleased section.

prowler/lib/powershell/powershell.py

tests/providers/m365/services/defender/defender_safe_attachments_policy_enabled/__init__.py

prowler/providers/m365/services/defender/defender_service.py

HugoPBrito · 2026-01-26T15:40:30Z

...efender/defender_safe_attachments_policy_enabled/defender_safe_attachments_policy_enabled.py

+            else:
+                # For other policies, check if they have secure settings
+                if policy.enable and policy.action == "Block":
+                    report.status = "PASS"
+                    report.status_extended = f"Safe Attachments policy {policy.name} is enabled with Action=Block."
+                elif not policy.enable:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"Safe Attachments policy {policy.name} is not enabled."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Safe Attachments policy {policy.name} has Action={policy.action}, which is less secure than Block."
+
+            findings.append(report)
+
+        return findings


Default one applies to all users and domains, but custom ones may not. We have to check the higher priority one and ensure all users and domains are selected.
Please use defender_antispam_outbound_policy_configured as reference.

andoniaf requested review from a team as code owners January 20, 2026 09:56

github-actions bot added provider/m365 Issues/PRs related with the M365 provider metadata-review labels Jan 20, 2026

feat(m365): add defender_safe_attachments_policy_enabled security check

8eb2e7c

Add new security check defender_safe_attachments_policy_enabled for m365 provider. Includes check implementation, metadata, and unit tests.

andoniaf force-pushed the feat/prowler-708-defender-safe-attachments-policy-enabled branch from caa4de6 to 8eb2e7c Compare January 20, 2026 09:56

andoniaf added 2 commits January 20, 2026 11:12

chore: fix black formatting

4feff3f

This was referenced Jan 20, 2026

feat(m365): add defender_atp_safe_attachments_policy_enabled security check #9837

Open

feat(m365): add defender_zap_for_teams_enabled security check #9838

Merged

andoniaf added 2 commits January 21, 2026 11:39

fix(m365): remove unnecessary __init__.py from test folder

ca904a0

Test folders should not contain __init__.py files. Only check implementation folders require them for proper module loading.

fix(m365): FAIL when no Safe Attachments policies exist

b8e83d0

When no Safe Attachments policies are found, the check now returns a FAIL finding instead of no findings. This aligns with Maester/CIS expectations that absence of required security features indicates non-compliance.

feat(m365): map defender_safe_attachments_policy_enabled to CIS compl…

64b9598

…iance Map the new defender_safe_attachments_policy_enabled check to: - CIS 4.0 M365 requirement 2.1.4 - CIS 6.0 M365 requirement 2.1.4

github-actions bot added the compliance Issues/PRs related with the Compliance Frameworks label Jan 23, 2026

andoniaf and others added 3 commits January 23, 2026 14:39

Merge remote-tracking branch 'origin/master' into feat/prowler-708-de…

0db9175

…fender-safe-attachments-policy-enabled

docs(changelog): move entry to v5.18.0 unreleased section

d2aa0e9

Move defender_safe_attachments_policy_enabled entry from v5.17.0 (already released) to v5.18.0 unreleased section.

feat: enhance missing module error handling

8dc3c34

HugoPBrito requested changes Jan 26, 2026

View reviewed changes

HugoPBrito mentioned this pull request Jan 26, 2026

feat(m365): add defender_safelinks_policy_enabled security check #9832

Open

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(m365): add defender_safe_attachments_policy_enabled security check #9833

feat(m365): add defender_safe_attachments_policy_enabled security check #9833

andoniaf commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

codecov bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

HugoPBrito commented Jan 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

HugoPBrito Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

feat(m365): add defender_safe_attachments_policy_enabled security check #9833

Are you sure you want to change the base?

feat(m365): add defender_safe_attachments_policy_enabled security check #9833

Conversation

andoniaf commented Jan 20, 2026

Context

Description

Steps to review

Checklist

SDK/CLI

License

Uh oh!

github-actions bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Container Security Scan

📊 Vulnerability Summary

⚠️ Action Required

Uh oh!

HugoPBrito commented Jan 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

HugoPBrito Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Jan 20, 2026 •

edited

Loading

github-actions bot commented Jan 20, 2026 •

edited

Loading

codecov bot commented Jan 20, 2026 •

edited

Loading

github-actions bot commented Jan 20, 2026 •

edited

Loading