Data Protection Issues

How to Notify Users When SharePoint Blocks a Malicious File

Bushra Parveen Sep 30, 2026 869 views

Question details

The user wants to automatically notify a specific person via email when SharePoint detects and blocks a malicious or suspicious file.

How to Notify a User When SharePoint Blocks a Malicious File

Product: SharePoint Online
Device & OS: not provided
Scenario: A suspicious or malicious file is uploaded to SharePoint, prompting the system to block it and display a warning icon.
Observed behavior: SharePoint blocks the file and warns users trying to download it, but does not natively send an automatic email notification to a designated admin or user.

Before you start

Ensure you have administrative privileges in your Microsoft 365 environment, as setting up advanced alerts or automation requires access to the Microsoft 365 Defender portal or Power Automate.

Solution 1Recommended

Set up Alerts using Microsoft Defender for Office 365

Configure automated alerts for malware detection through the Microsoft 365 Defender portal to notify specified users.

While SharePoint Online does not have a built-in email notification for blocked files, administrators can leverage Microsoft Defender to trigger alerts when malware is detected across SharePoint, OneDrive, or Teams.

Access the Defender Portal

Navigate to Alert Policies

Go to 'Policies & rules' in the left-hand navigation menu and select 'Alert policies'.

Locate the Malware Policy

Search for the default policy named 'Malware detected in SharePoint, OneDrive, or Microsoft Teams'.

Add Notification Recipients

Edit the policy settings and add the specific email addresses of the users or administrators you want to notify under the 'Recipients' section, then save your changes.

Set up Alerts using Microsoft Defender for Office 365

Licensing Requirement: This solution requires your organization to have an active Microsoft Defender for Office 365 Plan 1 or Plan 2 license.

Solution 2

Create an Email Notification Workflow via Power Automate

Build a customized automation flow to send an email when a file is flagged by the system.

Free Microsoft Office alternative

Experience Secure and Lightweight Document Management with WPS Office

While enterprise cloud security and malware detection are handled at the server level by SharePoint, managing and protecting your local files efficiently is equally important. WPS Office provides a highly compatible, lightweight alternative to Microsoft Office for creating, editing, and securing your local documents.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your specific operating system.
2. Install the Software: Run the downloaded setup file and follow the straightforward on-screen instructions to complete the installation.
3. Secure Your Documents: Open WPS Office, create or edit your files, and utilize the built-in encryption features to password-protect your sensitive information.

Fully compatible with Microsoft Office formats (DOCX, XLSX, PPTX) for seamless file sharing.Built-in document encryption and password protection settings to secure sensitive local data.Lightweight desktop application that runs smoothly on all major operating systems.Free to use with a familiar, easy-to-navigate tabbed interface.

microsoft office alternative - wps office

Frequently Asked Questions

Does SharePoint natively email users when a malicious file is blocked?

No, SharePoint Online does not provide a built-in setting to automatically email a specific user or admin when it detects and blocks a suspicious file. It relies on displaying warning icons in the interface.

What happens when a user tries to download an infected file from SharePoint?

When a user attempts to download a file that has been flagged as malicious, SharePoint blocks the download action and displays a warning message indicating that the file is infected and cannot be accessed.

Can Microsoft Defender help with SharePoint malware alerts?

Yes, if your organization uses Microsoft Defender for Office 365, administrators can configure Alert Policies to send automated email notifications whenever malware is detected in SharePoint, OneDrive, or Teams.

Are Power Automate flows effective for custom malware notifications?

Power Automate can be used to build custom notification workflows, but it typically requires advanced configuration—such as utilizing the Microsoft Graph API—to accurately read the underlying malware status of a SharePoint file before triggering an email.

Microsoft Office Security Issues