How to Restrict OneDrive Uploads and Sharing Before Malware Scanning
Question details
The organization needs to block executable file uploads from unmanaged devices and prevent file sharing in OneDrive or SharePoint before asynchronous malware scanning completes.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Securing file uploads and managing external sharing in an organizational environment.
- Observed behavior
- Microsoft 365 scans files asynchronously, meaning users can share them before the malware scan finishes. Additionally, there is no native policy to block specific file types exclusively from unmanaged devices.
Ensure you have global administrator or SharePoint administrator privileges in Microsoft 365 to configure tenant-level security settings and PowerShell access.
Manage Access for Unmanaged Devices
Since Microsoft 365 cannot selectively block uploads by file type only for unmanaged devices, you must restrict access or block uploads entirely for these devices.
By enforcing access control policies at the tenant level, administrators can prevent unauthorized file uploads from external or non-domain devices.
Log in to the Microsoft 365 Admin Center and navigate to the SharePoint admin center.
In the left pane, expand Policies and select Access control, then click on Unmanaged devices.
Select 'Allow limited, web-only access' or 'Block access' to prevent files from being uploaded or downloaded from devices not joined to your domain.
Prevent Downloading of Infected Files
Because malware scanning runs asynchronously after upload, you cannot prevent sharing during the scan, but you can block the download of files once identified as infected.
Try WPS Office for Secure and Lightweight Document Management
While Microsoft 365 provides complex enterprise administration, WPS Office offers a free, highly compatible, and lightweight alternative for individual and team document editing. Enjoy familiar interfaces and full compatibility with Microsoft Office formats without heavy subscription fees.
Frequently Asked Questions
Can I block specific file types from being uploaded to OneDrive?
Yes, you can use the SharePoint admin center or PowerShell to block specific file extensions (like .exe) for all users, but this restriction cannot be limited solely to unmanaged devices.
Why does Microsoft 365 allow sharing before the malware scan finishes?
Malware scanning in Microsoft 365 runs asynchronously to ensure uploads are fast and do not interrupt user workflows. However, this creates a brief window where files can be shared before being flagged.
How do I know if a file in OneDrive is infected with malware?
If Microsoft Defender for Office 365 detects a malicious file, a shield icon with a red X will appear next to the file name, and users will be restricted from downloading or syncing it based on tenant policies.
