Safe Documents is a premium F5 Security & Compliance licence feature enabled for the benefit of NHSmail Enhanced Service users across the NHSmail platform. It is part of the Safe Attachments policy in Microsoft Defender for Office 365.
Safe Documents works by opening documents in Protected View, scanning them and if they are deemed malicious, keeping threats contained in Protected View where users will be blocked from leaving Protected View.
Access to legitimate files will be unaffected. When a scan is completed and no threat is detected, the file is deemed to be safe, and users can then turn on editing and leave Protected View.
- This feature will be available to all users covered by the NHSmail Enhanced Service licence provision.
- Users do not need Defender for Endpoint installed on their local devices to get Safe Documents protection.
- Safe Documents will cover all files and documents sent from external and internal accounts (from accounts that are nhs.net and all other email accounts that are not nhs.net ) to nhs.net accounts.
- Files sent from nhs.net accounts to external (non nhs.net) accounts are not covered by Safe Documents.
- Safe Documents is applied in any document opened in Office 365 (O365) applications.
What are the benefits of Safe Documents?
Enabling this feature unlocks an additional layer of security on documents opened within an Office 365 application, thereby protecting all NHSmail users and their devices.
How does Safe Documents work?
Safe Documents leverages the cloud back-end of Defender for Endpoint to scan opened Office documents in Protected View. While a scan is in progress, Safe Documents will prevent users from exiting the Protected View container until results of the scan have been determined. Users can still read the document at this stage but cannot make any edits.
Below are the expected results from Safe Documents verification.
1. File currently being scanned by Microsoft Defender Advanced Threat Protection (MDATP). Shown while Safe Documents scans the file against MDATP. Maximum file upload size is 60 MBs.
2. Error in file verification. This error is shown if there are issues verifying the file, such as timeout and network connectivity issues. Users can still turn on editing, but caution is advised.
What happens if a document is malicious?
If a file is found to be malicious by the scan, users will not be able to leave Protected View and will be unable to edit the file or document. As such, these threats will be contained in Protected View and users will be blocked from leaving this container
Not sure if your document is malicious?
If an NHSmail user would like to release a blocked document or file which they believe has been incorrectly deemed malicious, they should contact the Helpdesk at firstname.lastname@example.org using the template outlined below. Your ticket will then be submitted to Microsoft for review.
It is important the approved email subject and email body template are used when raising a ticket with the Helpdesk. This will allow the agent to locate your email and process onwards with Microsoft. Failure to do so may result in your ticket being closed.
All existing email security features will remain active and in place. Safe Documents has been enabled for NHSmail Enhanced Service users (only) to protect documents opened within Office applications to build on and enhance existing security features.
If an NHSmail user would like to release a blocked document which they believe has been incorrectly blocked, they should contact email@example.com using the process and template outlined above in this article.
The F5 licence delivering Safe Documents functionality is applied to all users within Enhanced Organisation owned user policies and managed via the NHSmail Portal.
Only NHSmail Helpdesk central administrators can release files that have been blocked. This is because any files which have been blocked may contain malicious content and a careful assessment of the threat level posed by releasing blocked content will need to be conducted prior to release. All files identified as malicious will be shared with Microsoft for analysis.
As this feature is enabled and managed centrally, neither NHSmail users nor Local Administrators can disable Safe Documents.
If you believe that Safe Documents is causing issues in your use of NHSmail, please raise a ticket with firstname.lastname@example.org.
|Last Reviewed Date