Risky attachments

Most malware arrives as an attachment that runs code when opened. Mail to and from your tenant's mailboxes carrying one is refused, and the sender is told which file and why. It is on for every tenant unless its owners or admins turn it off.

What counts as risky

Programs: .exe, .scr, .com, .pif, .msi, .msp, .dll, .cpl, .jar, .app, .apk, .pkg and the like.
Scripts: .js, .jse, .vbs, .vbe, .wsf, .bat, .cmd, .ps1, .hta, .reg and the like.
Shortcuts: .lnk, .url, .website.
Disk images: .iso, .img, .vhd, .vhdx, .dmg, often used to slip a program past other checks.
Office documents with macros: .docm, .xlsm, .pptm and the other macro formats, and any Word, Excel or PowerPoint file found to hold macros whatever its name.

Files are judged by their name and by what they really are, so a program renamed invoice.pdf is still found. Zip files are looked inside (and zips inside them, one level). Names hidden behind a trailing dot or in encoded headers count too.

Ordinary attachments (PDFs, pictures, Word, Excel and PowerPoint files without macros, zip files of them) are never affected.

What happens

Mail from outside to your mailboxes is refused before it is accepted. The sending server reports it to its sender: "Message refused: it carries setup.exe (a program or script), which the recipient's organization does not accept."
Mail your users send (webmail, mail apps) is refused at once, with the same reason, before it counts against sending limits.
Mail between two tenants here is refused when either one blocks risky attachments.
One message has one answer, so a message to several people is refused for all of them when any recipient's tenant blocks it.

Message trace shows an attachments step with the file and why.

Share such files another way: a link to a file store, or a zip with a password the recipient is given separately (an encrypted zip still shows its file names, so a program inside one is still found by name).

Turning it off or on

Owners and admins: in the tenant manager (/manage), Settings → Security, card Risky attachments, tick or untick Block risky attachments. From the API: PATCH /v1/tenants/{tenantId}/team-settings with {"blockRiskyAttachments": false}.

Turning it off lets such files reach your mailboxes and leave them. It does not let your users send them to another tenant here that blocks them. Viruses that the virus scanner recognises are refused either way (see Spam and Junk).

Not yet

Archives other than zip (.rar, .7z) are not looked inside; a risky name on the archive itself still counts.