SharePoint Document Issues

How to Remove a Malware Block from a Clean SharePoint Online File

Natalie Taylor Oct 1, 2026 868 views

Question details

The user needs to remove a persistent malware block from a SharePoint Online file that has already been verified as clean by Microsoft Defender.

How to Remove a Malware Block from a Clean SharePoint Online File

Product: SharePoint Online
Device & OS: not provided
Scenario: A file in SharePoint Online was incorrectly flagged for malware, submitted for review, and verified clean by Microsoft Defender, but the block has not been lifted.
Observed behavior: The file remains blocked, is older than 30 days, and does not appear in the standard Microsoft Defender quarantine workflow for administrators to release.

Before you start

Ensure you have SharePoint Administrator privileges and access to the SharePoint Online Management Shell (PowerShell). Verify that Microsoft Defender has officially confirmed the file is clean before attempting to bypass the block.

Solution 1Recommended

Use PowerShell to Download and Re-upload the File

Since the file is older than 30 days and missing from the normal quarantine workflow, administrators must use PowerShell to safely extract the content and upload it as a clean file.

Because the file is older than 30 days, the standard Microsoft 365 Defender quarantine release options are no longer available in the security center. Bypassing the user interface using PowerShell is the most effective administrative workaround.

Open SharePoint Management Shell

Launch the SharePoint Online Management Shell as an administrator and connect to your SharePoint admin center using the Connect-SPOService cmdlet.

Download the blocked file

Execute the Get-SPOMalwareFileContent cmdlet to safely download the blocked file to your local computer.

Delete the blocked copy

Navigate to the SharePoint document library where the blocked file resides and delete it completely from the platform.

Re-upload with a new name

Upload the downloaded clean file back into the SharePoint library. To prevent the system from caching the previous block, consider renaming the file before uploading it.

Use PowerShell to Download and Re-upload the File

Microsoft Support Escalation: If the file becomes blocked again immediately after re-uploading, the file hash is likely still flagged in the backend. You will need to contact Microsoft Support for an administrator-level remediation.

Free Microsoft Office alternative

Need a Reliable Alternative for Managing Documents? Try WPS Office

If SharePoint and Microsoft Office restrictions are slowing down your workflow, consider using WPS Office. It provides a lightweight, highly compatible alternative for creating, editing, and sharing documents without the complex quarantine hurdles of Microsoft's ecosystem.

1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the software: Run the installer and follow the simple on-screen instructions to set up the office suite on your device.
3. Start working on your files: Open your downloaded documents directly in WPS Office to edit them seamlessly.

Fully compatible with Microsoft Word, Excel, and PowerPoint file formats.Lightweight installation with rapid startup and smooth operation.Built-in cloud collaboration tools for secure and straightforward document sharing.Familiar, user-friendly interface that requires zero learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

Why doesn't the blocked SharePoint file appear in the Defender quarantine workflow?

Files typically remain in the Microsoft Defender quarantine for a maximum of 30 days. If the file is older than this threshold, it will drop out of the standard quarantine view, making manual removal via the security center interface impossible.

Can I download a malware-blocked file directly from the SharePoint web interface?

No, SharePoint automatically disables standard download and sharing capabilities for files flagged for malware to prevent the spread of infections. You must use the SharePoint Online Management Shell and the Get-SPOMalwareFileContent cmdlet.

What should I do if the re-uploaded file gets blocked again immediately?

Sometimes the Microsoft Defender backend caches the file hash and continues to block it even after a manual review. Try renaming the file or making a minor edit to it locally before re-uploading. If it still blocks, you must escalate the issue to Microsoft Support.

Document & File Issues