MetaDefender for Microsoft 365 is an advanced solution that bolsters Microsoft 365’s native defenses with industry-leading threat prevention for email and files shared through Microsoft Teams. It is purpose-built to detect and neutralize malware, zero-day exploits, and embedded file-based threats, helping protect users across email and collaboration workflows.

This solution is powered by OPSWAT’s Metascan™ Multiscanning, adding more AV (antivirus) engines, MetaDefender Aether Sandbox for advanced dynamic threat analysis, and Deep CDR™ (Content Disarm & Reconstruction) for proactive content sanitization. By combining signature-based detection, behavioral sandboxing, and content sanitization, protection extends beyond traditional defenses to identify and neutralize both known and zero-day threats. With multiple layers of proactive protection and advanced technologies designed to combat evolving attack techniques, the solution deploys rapidly and integrates seamlessly with Microsoft 365, minimizing disruption to mail flow and Teams collaboration.

Microsoft OneDrive & SharePoint protection (Beta)

OneDrive & SharePoint are now protected channels alongside email. Once an administrator integrates with OneDrive and/or SharePoint, files uploaded are scanned before they can spread, and unsafe content is removed or sanitized automatically according to your policies.

What is scanned

• Files uploaded to OneDrive drives and folders.

• File uploaded to SharePoint sites and libraries

Large files are handled according to your configured scanning limits.

Policies and protection scope

• Per-channel policies — a policy can apply to email, Teams, OneDrive, SharePoint. The policies list and editor show which channels each policy covers.

• Choose who is protected — during onboarding you can protect your whole organization and sites, or scope protection to selected users, groups, sites or libraries.

• Works in Monitoring mode — you can run in Monitoring first to see what a policy would do before enforcing it.

Notifications and end-user release

• By email — users can be notified by email when a file is blocked or sanitized, using the same notification templates and per-verdict wording as email.

• Self-service release — external and guest recipients can request a blocked file through the one-time-passcode quarantine flow, the same journey already used for email.

Visibility and reporting

• Dashboard — a dedicated integration statistics section shows Files activity next to the other channels, with period-over-period trend indicators on the headline counters.

• Events — a Channel column distinguishes Exchange, Teams, OneDrive and SharePoint.

• Reports — OneDrive senders and Sites appear in top-blocked reporting, and detected threat names are recorded against quarantined items.

• Audit and SIEM — OneDrive & SharePoint actions are written to the audit trail, and the channels are included in data forwarded to your SIEM. 

Other improvements

Enhancements

• Added channel quick-filter tabs to Events and all four channels to the Events and Quarantine filters and columns

• Added a Clone action that creates a deactivated copy of any policy, the default policy included

• Added Advanced Workflow Properties to Policy Details, applied to every MetaDefender Cloud workflow of the policy

Onboarding

• Fixed Exchange-specific completion banners appearing on Teams-only integrations

Bugs

• Fixed Teams messages being lost when a failed fetch could not be parked or a notification could not be published

• Fixed Teams notifications being rejected after a Teams subscription was recreated

• Fixed retried Microsoft Graph subscription creates being rejected because the retry sent an empty body

• Fixed Teams coverage staying off when a rich subscription came back basic and could not be deleted, blocking later creates

• Fixed remediation retries for some Teams findings never running or never ending

• Fixed releasing a Teams item whose retries ran out failing with "This item is no longer actionable"

• Fixed Content Sanitization counts and the Sanitized File Type filter disagreeing with event details and View details

• Fixed the Events Direction filter returning no results for Internal events

• Fixed Teams audit history showing a Microsoft 365 id instead of the end user's email

• Fixed scan-retry and throttling history entries on Teams events using email wording

• Fixed the OTP page still serving an email an admin had deleted, instead of reporting it as deleted

• Fixed event details not saying why a file was excluded from sanitization

• Fixed Recent Activity showing repeated entries and inconsistent titles, actors and names during onboarding

• Fixed the View arrow being disabled on Recent Activity entries for policies created during onboarding

• Fixed email templates overflowing or shrinking to unreadable sizes on mobile mail clients