Forum Discussion
Issue collecting files in M365 Defender
We are having an issue using the "Collect Files" option within M365 Defender. We perform a search for a file, select the option to "collect file" and it does nothing. When I go back to check 24hrs later. The collect files is greyed out and if I check manual actions, it states "For file to be uploaded, a device that has the file must be connected to the network."
I have tried this scenario on several files on several machines with the same result. I have also confirmed the hash to be sure I am grabbing the correct file.
Any thoughts?
4 Replies
- HeikeRitter
Microsoft
Are you sure the device(s) are active and still have the file(s)?- yes. As a test I selected a file from my device and I matched the file hash.
- HeikeRitterHmm... I honestly don't have any ideas, as the file should simply download if it's present and you have the right permissions (which you have, otherwise the option would not be there for you.
I checked our documentation too (https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-file-alerts?view=o365-worldwide#download-or-collect-file) - check the "important note"- maybe it was quarantined in the meantime?
