The Office 365 Advanced Threat Protection (ATP) feature provides automatic scanning of incoming email to ensure attachments and links in the email are safe to open. These features are referred to as Safe Attachments and Safe Links.


When email is received with attachments, Office 365 will automatically scan them to ensure the attachments are safe to open or download. While the scanning is occurring, the attachments will not be available.

If an email is opened before Office 365 has finished scanning, the user will see the message shown below. The attachment is replaced by an icon that looks like an email indicating the attachment is being scanned by the Office 365 ATP feature.


Double clicking the “ATP Scan in Progress” icon will present further details (as shown below) about the attachment scan process. While the scan is occurring, a preview feature allows safe viewing of the attachment. Click on the “Preview” button (as shown in the screenshot below), to safely view the attachment.


Once the scan is completed, if the attachment is safe, the status of the email is reset to unread, and the attachment is now safe to open or download. Unsafe attachments are blocked from access.


Links in email can be obvious or embedded into text as a hyperlink. Both types of web links can potentially lead to phishing or malware embedded web sites that can either lead to compromised email credentials or download unsafe content to your computer. Office 365 ATP will intercept and ensure the links are safe to access.


Hovering over either link will show Office 365 ATP has added additional information to the web link (as shown below). This additional information will allow Office 365 ATP to intercept web links before you visit them and prevent access to unsafe web sites.



If the target website of a link is unsafe, the user is presented with the screen shown below.



The user is warned the website was determined to be unsafe and presented with the option to continue regardless by accepting the risk. Do not proceed unless you’re 100% certain the link is safe.