3791164 - Password-Protected File Uploads: Functionality, Scanning Behavior, and Security Considerations

Questions commonly arise regarding:

• Whether password-protected file uploads are supported as standard functionality.
• Whether the configuration can be restricted by business object, role, user, or upload scenario.
• How password-protected files are handled by the malware scanning service.
• Which upload channels are affected by the setting.
• Security considerations associated with enabling password-protected file uploads.

This behavior is by design.

Password-protected files contain encrypted content that cannot be inspected by the malware scanning service.

When password-protected file uploads are enabled, the malware scanner can validate only the file container itself and cannot analyze the encrypted contents within the file. As a result, the scan result applies to the container rather than to the protected payload.

When the feature is disabled, password-protected files are identified and blocked by the attachment scanning process.

Enable Password-Protected File Uploads

1. Navigate to:

   System Settings → Data Administration → Attachment Configuration

2. Enable Password-Protected File Uploads.

3. Save the configuration.

The setting becomes effective immediately for the entire tenant.

---

Scope of the Configuration

The configuration is a tenant-wide setting.

Granular configuration is currently not available. The setting cannot be restricted by:

• Business object
• Attachment category
• Business role
• Individual user
• Upload scenario
• Integration channel

Once enabled, the behavior applies to all attachment uploads within the tenant.

---

Malware Scanning Behavior

When Disabled (Default)

• Password-protected files are detected during attachment scanning.
• Upload of password-protected files is blocked.

When Enabled

• Files continue to pass through the standard malware scanning service.
• The scanner evaluates only the encrypted file container.
• The scanner cannot inspect the protected contents.
• Uploads may receive a clean scan result even though the encrypted payload cannot be analyzed.

Important: A successful scan result indicates that the container itself does not contain detectable threats. It does not imply that the encrypted contents have been inspected.

---

Upload Channel Coverage

The validation occurs during attachment scanning and therefore applies consistently across all supported upload channels, including:

• User interface uploads
• API-based uploads
• Integration-based uploads
• Email-to-Case attachment processing
• Other attachment flows processed through the Document Service

---

Security Considerations

Before enabling password-protected file uploads, review organizational security and compliance requirements.

Because encrypted file contents cannot be inspected by the malware scanning service:

• Malicious content embedded within password-protected files cannot be analyzed during upload.
• End users are not informed whether the accepted password-protected file was fully content-scanned.
• Organizations should evaluate whether allowing encrypted attachments aligns with their internal security policies.

SAP's default recommendation is to keep password-protected file uploads disabled. Enabling this functionality should be considered only when there is a valid business requirement and the associated security implications have been assessed.

SAP Sales Cloud Version 2, SAP Service Cloud Version 2, password-protected file, password-protected upload, encrypted file, encrypted attachment, password protected attachment, attachment configuration, document service, malware scanning, virus scanning, attachment scanning