atpPolicyForO365

Defender Global Settings. Org-wide Safe Links and Safe Attachments for Office and Teams. The atpPolicyForO365 singleton lives under /exchange/v1.0/atpPolicyForO365 in the Threat protection category.

Fact	Value
Path	`/exchange/v1.0/atpPolicyForO365`
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	`ThreatPolicy.Read.All` (Community)
Write role	`ThreatPolicy.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-AtpPolicyForO365, Set-AtpPolicyForO365

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/atpPolicyForO365`	GET action - Ok. (Auto-generated stub summary; refine when the slice is touched next.)	`ThreatPolicy.Read`	Community
PATCH	`/exchange/v1.0/atpPolicyForO365`	PATCH /atpPolicyForO365 - singleton write (no key segment per EDM singleton convention). isSingleton: true drops -Identity from both Set + Get (EXO’s implicit-singleton lookup only fires when -Identity is omitted - passing -Identity Default 404s despite list-GET returning Identity=Default).	`ThreatPolicy.ReadWrite`	Enterprise

GET /exchange/v1.0/atpPolicyForO365

GET action - Ok. (Auto-generated stub summary; refine when the slice is touched next.)

Backing cmdlet: Get-AtpPolicyForO365. Role: ThreatPolicy.Read (Community).

List the ATP policy for Office 365

Returns the tenant ATP (Safe Documents / Safe Attachments for SharePoint, OneDrive & Teams) policy. Backed by Get-AtpPolicyForO365; the endpoint returns a single Default policy in a collection wrapper.

GET /exchange/v1.0/atpPolicyForO365 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#Collection(ExchangeApi.AtpPolicyForO365)",
  "value": [
    {
      "Id": "Default",
      "Name": "Default",
      "Identity": "Default",
      "Guid": "539c4d43-6fab-4f0b-a164-39260f941bbe",
      "EnableATPForSPOTeamsODB": true,
      "EnableSafeDocs": true,
      "AllowSafeDocsOpen": false,
      "TrackDocumentChanges": false,
      "WhenCreated": "2026-03-30T17:42:28+03:00",
      "WhenChanged": "2026-03-30T17:42:36+03:00",
      "AdminDisplayName": "",
      "DistinguishedName": "CN=Default,CN=Atp Policy For O365,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
      "ExchangeObjectId": "c6911a7c-d55a-4356-aab7-a9588d401222",
      "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
      "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
      "WhenChangedUTC": "2026-03-30T14:42:36Z",
      "WhenCreatedUTC": "2026-03-30T14:42:28Z"
    }
  ]
}

PATCH /exchange/v1.0/atpPolicyForO365

PATCH /atpPolicyForO365 - singleton write (no key segment per EDM singleton convention). isSingleton: true drops -Identity from both Set + Get (EXO’s implicit-singleton lookup only fires when -Identity is omitted - passing -Identity Default 404s despite list-GET returning Identity=Default).

Backing cmdlet: Set-AtpPolicyForO365. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type
`allowSafeDocsOpen`	body
`enableATPForSPOTeamsODB`	body
`enableSafeDocs`	body
`dryRun`	query	bool (switch)

Update the Safe Docs and Safe Attachments for SharePoint singleton

Updates the tenant ATP policy singleton via Set-AtpPolicyForO365. No key segment is used (EDM singleton convention); EXO’s implicit-singleton lookup only fires when -Identity is omitted.

PATCH /exchange/v1.0/atpPolicyForO365 HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "enableSafeDocs": true,
  "enableATPForSPOTeamsODB": true,
  "allowSafeDocsOpen": false
}

HTTP/1.1 200 OK
Content-Type: application/json; odata.metadata=minimal

{
  "Identity": "Default",
  "Id": "Default",
  "enableSafeDocs": true,
  "enableATPForSPOTeamsODB": true,
  "allowSafeDocsOpen": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.