Security Policy Errors

How to Fix SharePoint Blocking a Safe File as Malware

Algirdas Jasaitis Oct 10, 2026 869 views

Question details

A legitimate file uploaded or stored in SharePoint is being blocked due to a malware detection by Microsoft Defender.

How to Fix SharePoint Blocking a Safe File as Malware

Product: Microsoft SharePoint
Device & OS: not provided
Scenario: Attempting to access, download, or share a safe file in SharePoint that has been flagged as a threat.
Observed behavior: SharePoint displays a malware warning, restricts access, and prevents the user from opening or distributing the file.

Before you start

Do not attempt to bypass the warning or share the flagged file with others until it has been thoroughly reviewed and cleared by your IT administrator or security team.

Solution 1Recommended

Report to Your Security Team for False Positive Scanning

The safest and most reliable way to handle a blocked file is to follow organizational security procedures and use approved tools to verify if it is a false positive.

End users cannot bypass SharePoint's built-in malware protections. If a safe file is blocked, it means Microsoft Defender detected suspicious patterns or macros. You must involve your IT department to securely release the file.

Stop file distribution

Do not attempt to download, sync, or email the flagged file to other users, as this could spread potential threats across the network.

Contact IT support

Reach out to your organization's SharePoint administrator or IT security team to report that a legitimate file has been blocked.

Administrator scan

Request the administrator to scan the quarantined file using Microsoft Defender for Office 365 or other approved corporate security tools to confirm it is not malicious.

Report to Your Security Team for False Positive Scanning

False Positive Submissions: Only administrators can submit suspected false positives directly to Microsoft through the Microsoft 365 Defender portal.

Solution 2

For Administrators: Submit the File for Microsoft Analysis

IT administrators must manually review the quarantine logs and submit false positives to Microsoft to restore user access.

Free Microsoft Office alternative

Try WPS Office for Secure Document Collaboration

While dealing with Microsoft SharePoint security restrictions, consider WPS Office as a lightweight, free alternative for your daily document needs. It offers excellent compatibility with Microsoft formats, ensuring your workflow remains uninterrupted.

1. Download WPS Office: Visit the official WPS website to download the free installation package for your operating system.
2. Install and sign in: Run the installer and sign in with your email or social account to activate built-in cloud storage and collaboration tools.
3. Open your files: Simply double-click your existing docx, xlsx, or pptx files to open them seamlessly in the WPS Office suite.

Highly compatible with Microsoft Word, Excel, and PowerPoint file formats.Built-in cloud storage for secure document backup, editing, and sharing.Lightweight installation that runs smoothly on older or restricted hardware.Familiar, tabbed user interface for a seamless transition.

microsoft office alternative - wps office

Frequently Asked Questions

Why did SharePoint block my file if I know it is completely safe?

Microsoft Defender continuously scans files uploaded to SharePoint. If a file contains macros, specific scripts, or structural patterns that resemble known malware, Defender may flag it as a precaution. This is known as a false positive.

Can I manually bypass the SharePoint malware warning?

No, end users cannot bypass a malware block in SharePoint. Only administrators with appropriate permissions can review the file, release it from quarantine, or submit it for false-positive analysis.

Will a blocked file automatically be deleted from SharePoint?

No, the file is not immediately deleted. It is blocked and quarantined to prevent users from opening, syncing, or sharing it until an administrator resolves the security alert.

How long does Microsoft take to review a false positive submission?

Typically, Microsoft's security analysts review false positive submissions within 24 to 48 hours, though timeframes can vary based on the complexity of the file and the current submission queue.

Microsoft Office Security Issues