Data Protection Issues

Fix Microsoft Defender for Mac Missing Restore Option for Quarantined Files

Nimra Malik Sep 28, 2026 869 views

Question details

The user needs to recover a quarantined file flagged as a malware downloader by Microsoft Defender, but the system only provides a delete option.

How to Handle Quarantined Files with No Restore Option in Microsoft Defender for Mac

Product: Microsoft Defender for Mac
Device & OS: macOS
Scenario: Attempting to restore or allow a quarantined file that is required for legitimate security research.
Observed behavior: Microsoft Defender restricts the available quarantine actions to 'Delete file now', completely removing the 'Restore' or 'Allow' options for this specific file.

Before you start

Ensure you have absolute certainty about the file's nature before attempting any bypass. Interacting with verified malware downloaders on a primary machine can seriously compromise your macOS system and personal data.

Solution 1Recommended

Use an Isolated Test Environment for Malware Research

Since Defender permanently restricts access to severe threats on the host machine by design, use a secure, sandboxed environment to handle the research file without endangering your primary Mac.

Microsoft Defender intentionally removes the 'Restore' option for files it categorizes as highly critical threats (like malware downloaders). Attempting to weaken your main Mac's security to bypass this is unsafe.

Set up a Virtual Machine

Install a virtualization tool such as Parallels Desktop, VMware Fusion, or VirtualBox on your Mac to create a sandboxed environment.

Install an Isolated OS

Set up a separate operating system within the virtual machine strictly for research, ensuring it is disconnected from your main network or internet if necessary.

Transfer the File Securely

Obtain the file from its original source directly inside the virtual machine, or transfer it securely using an encrypted USB drive. Do not download it to your host macOS environment where Defender will intercept it.

Conduct Analysis

Perform your legitimate malware analysis exclusively inside the virtual machine, where Microsoft Defender policies from your main Mac will not enforce the 'Delete only' quarantine action.

Security Warning: Never disable Microsoft Defender Real-Time Protection or attempt to force-restore a known malware downloader on your primary Mac, as this can lead to immediate system compromise.

Solution 2

Submit the File for False Positive Review

If you believe the file is safe and was incorrectly classified as a severe threat, report it to Microsoft to potentially update their detection definitions.

Free Microsoft Office alternative

Switch to WPS Office for a Secure and Lightweight Mac Experience

While managing system security and strict Defender policies on your Mac, you need an office suite that is reliable, secure, and doesn't interfere with your workflow. WPS Office provides excellent capabilities in a lightweight package without complex background services.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight architecture ensures smooth performance on macOS without draining system resources.Built-in document protection and auto-backup features keep your data secure.Clean, intuitive tabbed interface for seamless, distraction-free document management.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Microsoft Defender for Mac only show 'Delete file now'?

Defender automatically hides the 'Restore' or 'Allow' options for files classified as high-risk malware or severe threats. This is a built-in safety mechanism to prevent users from accidentally executing dangerous code.

Can I temporarily disable Defender to restore the file?

While it is technically possible to disable Real-Time Protection in the settings, doing so to restore a severe threat is highly discouraged. It exposes your entire macOS system to the malware downloader, which could compromise your device immediately.

How can I prevent Defender from quarantining my research folders?

You can add exclusions by opening Microsoft Defender, going to Settings > Exclusions, and adding the specific folder path. However, files already quarantined as severe threats usually cannot be exempted retroactively.

Microsoft Office Security Issues