Download attachments and the reported email safely
You can download any attachment that passed the malware scan, and the full reported email as an .eml file. Attachments with detected malware cannot be downloaded.
Security tools on your computer, such as EDR or antivirus, may quarantine or flag a suspicious file as soon as it is saved. To avoid this, turn on Password-protect downloads. Each download then saves as a .zip file that is protected with the password infected. Security tools cannot scan inside the zip, so the file reaches your computer intact.
Turn it on
Go to Settings > Email Security > Admin experience.
Turn on Password-protect downloads.
The setting is off by default. When it is off, downloads save as the original files.
To change this setting, an admin needs edit access to Settings, Phish Triage, or Email Security.
Download a file
Attachment: open the event, go to the Links & attachments tab, and click the download icon on the attachment. The file saves as
<attachment name>.zip.Reported email: open the event, go to the Headers and metadata tab, and click Download .eml zip. The file saves as
reported-email-<event id>.eml.zip.
After each download, a message shows the zip password.
Open the file
Open the zip with any standard zip tool and enter the password infected. Only open potentially malicious files in an isolated environment, such as a sandbox or a dedicated analysis machine.