Security Policy Errors

Fix False Malware Detection in SharePoint Files

Huda Qurayshi Sep 30, 2026 868 views

Question details

A SharePoint document has been falsely flagged as malware but cannot be released because it is missing from the Microsoft Defender quarantine section.

How to Release a False Malware Detection in a SharePoint File

Product: Microsoft SharePoint
Device & OS: not provided
Scenario: An administrator needs to restore access to an older SharePoint document incorrectly classified as malware without deleting it, which would break organizational links.
Observed behavior: The file is blocked due to malware detection but does not appear in the Files tab of Microsoft Defender quarantine, preventing standard release.

Before you start

Verify that you have Microsoft 365 Global Administrator or Security Administrator privileges, as you will need to access the admin center to submit a service request.

Solution 1Recommended

Submit a Service Request via Microsoft 365 Admin Center

Since the falsely flagged file is missing from the quarantine list, you must contact Microsoft Defender support to manually investigate and release the item.

It is crucial not to delete or re-add the affected SharePoint file if it is heavily referenced throughout your organization. Replacing the file will permanently break existing links and disrupt workflows.

Access Microsoft 365 Admin Center

Open a New Service Request

Navigate to the 'Support' section on the left-hand navigation menu and click on 'New service request'.

Detail the False Positive Issue

Describe the problem clearly, specifying that an older SharePoint file was flagged as malware but is not visible in the Files section of Microsoft Defender quarantine.

Submit for Investigation

Submit the ticket. The Microsoft Defender support team will investigate the detection signature and determine how to release the file or correct the false positive.

Submit a Service Request via Microsoft 365 Admin Center

Do Not Delete the File: Leave the quarantined file exactly where it is while waiting for support to resolve the issue to maintain file integrity and linked references.

Free Microsoft Office alternative

Try WPS Office for Secure Document Collaboration

If complex admin restrictions or unexpected file access issues disrupt your workflow, consider WPS Office. It provides a highly compatible, secure, and user-friendly environment for editing and sharing files.

1. Download the Installer: Visit the official WPS Office website and click the free download button.
2. Install the Software: Run the setup file and follow the on-screen instructions to install WPS Office on your device.
3. Start Creating: Open WPS Office and instantly view, edit, or collaborate on your existing Office documents.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight architecture ensures fast loading and smooth performance.Secure document editing and cloud sharing capabilities.Familiar user interface with zero learning curve for Office users.

microsoft office alternative - wps office

Frequently Asked Questions

Why isn't the flagged SharePoint file showing up in Microsoft Defender quarantine?

This usually happens due to synchronization delays, specific backend policy routing, or a glitch in how Defender catalogs false positives for older SharePoint documents.

Can I just delete the flagged file and upload a new copy?

While uploading a new copy might bypass the immediate malware flag, it is not recommended for shared files because it will break all existing hyperlinks and references used by your organization.

Who has the permission to release quarantined files in Microsoft 365?

Only users assigned to specific administrator roles, such as Security Administrator, Organization Administrator, or Quarantine Administrator, have the authority to manage and release quarantined items.

Microsoft Office Security Issues