File Sharing between licensed account holders

This is well known and you may configure custom quarantine policies, enable notifications, and report false positives via the Defender portal. This reduces manual monitoring and ensures legitimate collaboration is not blocked. 

https://learn.microsoft.com/en-us/defender-office-365/quarantine-admin-manage-messages-files

https://learn.microsoft.com/en-us/defender-office-365/quarantine-policies

Licensing does not exempt a message from Defender filtering, so a legitimate sharing notification can be quarantined if its sender, URL, attachment, spoof signal, or policy produces a malware verdict. Open one recent example in the Microsoft Defender portal and inspect the email entity. Record the detection technology, threat type, policy, sender authentication, URLs, attachments, and overrides; this shows whether anti-malware caused the action. Verify the notification and shared file independently before release. If clean, submit the original quarantined message to Microsoft as a false positive and review the returned verdict. Use a temporary, narrowly scoped Tenant Allow/Block List entry only through that submission workflow if continuity requires it. Do not create a broad transport-rule bypass for Microsoft domains or sharing messages, because other entities would evade filtering. Compare several affected messages to find the common detected entity; if submissions remain misclassified, open Microsoft support with message IDs and results.

Yes. The issue is usually one of two things:

 1. Email sharing notifications being quarantined
Check Microsoft Defender > Email & collaboration > Policies & rules > Threat policies > Anti-malware.
Look at the Common Attachment Types Filter. If legitimate file types such as .docx, .xlsx, .pdf, or .zip have been added, remove them.

 2. Actual shared files being quarantined in SharePoint/OneDrive/Teams
Check Quarantine > Files and look at the Detected by field:

• AV = antivirus/signature detection
• MDO = Safe Attachments for SharePoint/OneDrive/Teams

For confirmed false positives, submit the file as clean, then add the file hash to the Tenant Allow/Block List, and release the file. Avoid broad exclusions.

Also check the audit log for recent security policy changes, such as enabling Standard or Strict preset security policies.

This is the correct, safe diagnostic path.

My answers are voluntary and without guarantee!

Hope this will help you.

Hi, 

You can start by checking the exact quarantine reason in Microsoft Defender (Malware, Phishing, Safe Attachments, etc.).

Based on your description, it's difficult to determine whether this is an Anti-Malware issue, a Safe Attachments verdict, or another Defender policy.

Has anything changed recently in your Defender policies or security configuration?

The quarantine verdict should provide the first clue to identifying the root cause.