Microsoft keeps alerting that a malware file has been uploaded into SharePoint.

Question

Microsoft keeps alerting that a malware file has been uploaded into sharepoint. Nothing in the file is malicious. Have ran through multiple sandboxes and everything comes out clean. How can I see what or why Microsoft keeps labeling this file as malware?

Answer 1

Hi Paul,

This is part of Microsoft Defender for Office 365 functionality.

View information about malicious files detected by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

And how to manage quarantine - Take action on quarantined files

Best regards,

Aleksandr

---

If the response is helpful, please click "Accept Answer" and upvote it.

Answer 2

Microsoft 365 uses a common virus detection engine for scanning files that users upload to SharePoint Online, OneDrive, and Microsoft Teams. This protection is included with all subscriptions that include SharePoint Online, OneDrive, and Microsoft Teams. This is an automatic process in the background.

The recommended way is to delete the flag file then re-upload the file.

Or you could open a service request with Microsoft to find the reason from the backend.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Emily,

Thank you for the input. Yes, I am going to open a ticket because I want see the actual meta data they see or saw as malicious. The file in question is completely safe so, not sure what it sees. Perhaps someone categorized our link as malicious? Thanks for your insight here.