Forum Discussion
File Sharing between licensed account holders
From a starting point of this year, we have been finding that any to most file shares that happened between licensed MS account users are being flagged and quarantined by the anti-malware policy. This should be, we are looking to resolve this issue. Has anyone else experienced this issue and what was your resolve. At the moment we have to monitor the quarantines and manually go in to release the share notifications.
2 Replies
Yes. The issue is usually one of two things:
1. Email sharing notifications being quarantined
Check Microsoft Defender > Email & collaboration > Policies & rules > Threat policies > Anti-malware.
Look at the Common Attachment Types Filter. If legitimate file types such as .docx, .xlsx, .pdf, or .zip have been added, remove them.2. Actual shared files being quarantined in SharePoint/OneDrive/Teams
Check Quarantine > Files and look at the Detected by field:- AV = antivirus/signature detection
- MDO = Safe Attachments for SharePoint/OneDrive/Teams
For confirmed false positives, submit the file as clean, then add the file hash to the Tenant Allow/Block List, and release the file. Avoid broad exclusions.
Also check the audit log for recent security policy changes, such as enabling Standard or Strict preset security policies.
This is the correct, safe diagnostic path.
My answers are voluntary and without guarantee!
Hope this will help you.
Hi,
You can start by checking the exact quarantine reason in Microsoft Defender (Malware, Phishing, Safe Attachments, etc.).
Based on your description, it's difficult to determine whether this is an Anti-Malware issue, a Safe Attachments verdict, or another Defender policy.
Has anything changed recently in your Defender policies or security configuration?
The quarantine verdict should provide the first clue to identifying the root cause.
