MetaDefender Cloud Email Security has been renamed MetaDefender for Microsoft 365. The new name reflects the product’s expanded protection capabilities across Microsoft 365, extending beyond email security to include support for Microsoft Teams.

MetaDefender for Microsoft 365 can now also analyze attachments shared in supported Teams channels, helping organizations detect and prevent malicious or unsafe content across their Microsoft 365 environment.

This solution is powered by OPSWAT’s Metascan™ Multiscanning, adding more AV (antivirus) engines, MetaDefender Aether Sandbox for advanced dynamic threat analysis, and Deep CDR™ (Content Disarm & Reconstruction) against file-based threats. By combining signature-based detection, behavioral sandboxing, and proactive content sanitization, content security extends beyond traditional defenses to identify and neutralize both known and zero-day threats. With multi-layered, proactive protection and advanced technologies designed to combat evolving attack techniques, the solution deploys rapidly and integrates seamlessly without disrupting business flows.

Microsoft Teams protection (Beta)

Teams is now a protected channel alongside email. Once an administrator integrates with Teams, files shared through Teams are scanned before they can spread, and unsafe content is removed or sanitized automatically according to your policies.

What is scanned

• Files attached to one-to-one and group chat messages

• Files posted to team channels, including files attached to replies

• Files shared in meeting chats

Large files are handled according to your configured scanning limits.

Policies and protection scope

• Per-channel policies — a policy can apply to email, to Teams, or to both. The policies list and editor show which channels each policy covers.

• Choose who is protected — during onboarding you can protect your whole organization, or scope protection to selected users or groups. Group membership is resolved automatically, so people added to a protected group are covered without further configuration.

• Works in Monitoring mode — you can run Teams in Monitoring first to see what a policy would do before enforcing it.

Notifications and end-user release

• In Teams — affected users receive a notification in the Teams activity feed, including for channel posts and replies. Notifications are sent by a dedicated application and require no additional consent from your organization.

• By email — users can also be notified by email when a Teams file is blocked or sanitized, using the same notification templates and per-verdict wording as email.

• Self-service release — external and guest recipients can request a blocked Teams file through the one-time-passcode quarantine flow, the same journey already used for email.

Visibility and reporting

• Dashboard — a dedicated integration statistics section shows Teams activity next to email, with period-over-period trend indicators on the headline counters.

• Events — a Channel column distinguishes Exchange from Teams, and Teams events carry sender, conversation and message detail.

• Quarantine — Teams items show channel, sender, recipients and conversation, with a preview of the original message and channel filters in advanced search.

• Reports — Teams senders and recipients appear in top-blocked reporting, and detected threat names are recorded against quarantined items.

• Audit and SIEM — Teams actions are written to the audit trail at parity with email, and the channel is included in data forwarded to your SIEM. 

Other improvements

Onboarding

• Select more than one Microsoft 365 channels in a single onboarding pass, with a summary of what will be protected before you commit.

• Integrations that are not yet enabled show an explanatory banner with a single action to enable them.

Dashboard

• Per-channel traffic information available.

Email templates and reports

• A reorganized template field picker with a clearer, hierarchical field list.

• New template & report designs available to new and existing tenants.

Bugs

• Fixed wrong counts in the Daily Scan Report

• Fixed users appearing twice in Reports – Recipients

• Fixed sanitized files being reported as threats in notifications and on the OTP page

• Fixed the OTP page reporting a successful release after the release had failed

• Fixed onboarding accepting admin consent that lacked required scopes instead of showing an error

• Fixed onboarding with all users in scope creating a content-actions policy that never applied

• Fixed a resumed onboarding continuing in Express mode after Advanced mode was selected

• Fixed very large file sizes being displayed in KB

• Cleaned up obsolete labels in Recent Activity, the Users list and action items