Your organization uses Defender for Office 365 Plan 1. You created a custom Safe Attachments policy that applies to the domain contoso.com and set the malware response action to Block. Users in the marketing department, whose mailboxes are on contoso.com, report that attachments are still being scanned but the built-in Standard preset security policy settings appear to take effect instead of your custom policy for some of them. You need to ensure your custom Safe Attachments policy reliably applies to these users. What should you verify first?