This guide explains how to interact with MetaDefender for Microsoft 365 when handling content with special actions required — such as encrypted files/attachments or blocked content.

When you receive content flagged by MetaDefender for Microsoft 365, you will be prompted to take one or more actions before accessing the message or its attachments.

The User Actions process involves:

Security Verification

When accessing flagged content, you will see a Security Verification Required screen.

The end user must:

• Enter his/hers email address.

• Click Verify to proceed.

This ensures only the intended sender/recipient can take further action.

Authentication

For security, MetaDefender for Microsoft 365 will send a One-Time Password (OTP) to the email address previously specified.

The end user must:

• Enter the OTP code on the verification page.

• Click Verify Code to continue.

Details

The Details section displays summary information about the quarantined content.

It includes:

• Status: Current processing status of the content (for example, Quarantined).

• Actions Required: Displays any action required before processing can continue, such as Provide Passwords.

• Conversation: [Teams only] Teams channel name, if present.

• From: Sender's email address.

• To: Recipient's email address.

• Subject: Subject (for example, email subject).

• Date Sent: Date and time the content was sent.

• Attachments: Number of attachments, including the number of encrypted attachments.

• Verdict: Final processing verdict or reason the content was held.

Why We Held It

The Why We Held It section explains why the content has been quarantined.

Common reasons include:

• Password-protected attachments that cannot be scanned.

• Attachments containing malware or other known threats.

• Files requiring additional verification before delivery.

This information helps recipients understand why the content has not yet been delivered.

Content

The Content section displays all files contained together with their current scan status.

Files are grouped by processing result.

Files We Couldn't Open

Lists password-protected files/attachments that could not be scanned.

For each item, you can:

• Review the name.

• Enter the password using the Enter Password field.

Once the correct password is provided, the content becomes eligible for rescanning.

Files That Came Back Clean

Displays files that were successfully scanned and determined to be safe.

Each file displays its processing result, for example:

• Sanitized

Rescanning the content

After entering the required password(s), select Rescan Content to submit the password and initiate a new scan.

During rescanning:

• The encrypted content is decrypted using the supplied password.

• MetaDefender for Microsoft 365 scans the content using configured detection and prevention technologies.

• If sanitization is enabled, eligible files are processed using Content Disarm and Reconstruction (CDR).

• The verdict is updated based on the scan results.

If content is determined to be safe and organizational policy permits, it is released to the recipient.

If malware is detected or the content cannot be safely processed, the content remains quarantined or is handled according to the configured security policy.

Password Requirements

• Enter the password exactly as it was used to encrypt the file/attachment.

• If multiple password-protected files/attachments are present, provide the password for each encrypted file.

• If an incorrect password is entered, the content cannot be scanned and remains quarantined until a valid password is provided.

Notes

• Passwords are used only for scanning and are not stored after processing.

• Rescanning does not bypass organizational security policies.

• Only users authorized to access the quarantined content can submit passwords and request a rescan.