Issue collecting files in M365 Defender

[Robert Young]

We are having an issue using the "Collect Files" option within M365 Defender.  We perform a search for a file, select the option to "collect file" and it does nothing.  When I go back to check 24hrs later.  The collect files is greyed out and if I check manual actions, it states  "For file to be uploaded, a device that has the file must be connected to the network."

I have tried this scenario on several files on several machines with the same result.  I have also confirmed the hash to be sure I am grabbing the correct file.

Any thoughts?

[#2]

Are you sure the device(s) are active and still have the file(s)?

[#3]

yes. As a test I selected a file from my device and I matched the file hash.

[#4]

Hmm... I honestly don't have any ideas, as the file should simply download if it's present and you have the right permissions (which you have, otherwise the option would not be there for you.
I checked our documentation too (https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-file-alerts?view=o...) - check the "important note"- maybe it was quarantined in the meantime?

[#5]

I will run through the test scenario again and see what happens. If it is still not working, I will open a ticket with Microsoft.

Will throw the solution on this thread in case someone else expierences the same issue.