How to Stop Microsoft Defender from Blocking Encrypted Data-Only ZIP Archives
Question details
Microsoft Defender is incorrectly flagging and blocking encrypted ZIP archives that contain only data and no executable code.
- Product
- Microsoft Defender
- Device & OS
- not provided
- Scenario
- Users are attempting to share, receive, or access an encrypted ZIP file containing harmless data, but the security system intercepts and removes it.
- Observed behavior
- The ZIP archive is blocked, quarantined, or completely removed by Microsoft Defender, requiring administrative intervention or a false-positive review to retrieve the data.
Verify that the blocked ZIP archive truly contains only safe data and no executable files before attempting to bypass Microsoft Defender security protocols.
Configure the Tenant Allow/Block List in Microsoft 365
Microsoft 365 administrators can add specific file hashes to the Tenant Allow/Block List to bypass detection securely.
This is the safest and most reliable method for enterprise environments. By explicitly allowing the file hash, you prevent Microsoft Defender from blocking the specific data-only ZIP archive without lowering your overall security posture.
Log in to the Microsoft 365 Defender portal using your administrator credentials.
Go to 'Policies & rules' in the navigation pane, then select 'Threat policies'.
Under the Rules section, click on 'Tenant Allow/Block Lists'.
Select the 'Files' tab, click the 'Add' button, and input the SHA256 hash of the blocked ZIP archive to allow it through the security filters.
Submit the Archive to Microsoft as a False Positive
Report the blocked encrypted ZIP directly to Microsoft to have the detection reviewed and safely bypassed on a global level.
Temporarily Disable Archive Scanning via PowerShell
Use Windows PowerShell to stop Microsoft Defender from scanning archives, allowing you to extract the ZIP contents.
Work With Encrypted Documents Safely Using WPS Office
While resolving Microsoft Defender security blocks, consider using WPS Office to manage your documents. Instead of relying on encrypted ZIP containers that trigger security warnings, WPS Office allows you to natively encrypt your Word, Excel, and PowerPoint files with high compatibility and zero hassle.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install WPS Office: Run the downloaded setup file and follow the on-screen instructions to complete the installation.
- 3. Encrypt Your Documents Natively: Open your document in WPS Office, go to Menu > Document Encryption, and set a secure password directly on the file.
Frequently Asked Questions
Why does Microsoft Defender block encrypted ZIP files that have no malware?
Because the archive is encrypted, Defender's scanning engine cannot inspect the internal contents. By default, restrictive security policies may block these opaque files as a precaution, assuming they might hide malicious executable payloads.
What is the safest way to bypass the archive block?
The safest approach is either adding the specific file hash to your Microsoft 365 Tenant Allow List or submitting the file to Microsoft as a false positive. This allows access without lowering your local machine's security posture.
Can a standard user add a file to the Defender Allow List?
No, modifying the Tenant Allow/Block List requires Microsoft 365 administrator privileges. Standard users encountering this block must contact their IT or security department for assistance.
