What to do when a malicious file is found in SharePoint Online, OneDrive, or Microsoft Teams
Applies ToSharePoint in Microsoft 365 Microsoft 365 admin OneDrive (work or school) Microsoft Teams OneDrive for Mac OneDrive for Windows SharePoint admin centre

You've come across a file in SharePoint in Microsoft 365, OneDrive for work or school, or Microsoft Teams, but you're unable to open or share it. You can see the file is there, but it's blocked and the file has a warning icon next to it:

Screenshot of files in OneDrive for Business with one detected as malicious

Delete the file (recommended)

To protect yourself, your computer, and your organization, the best option is to delete the file. From the OneDrive mobile app, your only option is to delete the file.

  1. Select the file you want to delete (on the mobile app, press and hold to select it).

  2. Select Delete.

    Screenshot of deleting a blocked file from OneDrive for Business from the OneDrive mobile app

    Deleting in the OneDrive mobile app

Download the file (if your organization allows it)

If your organization allows it, you can download the file by viewing your OneDrive in a web browser. You can then clean the file by whatever means your organization recommends.

  1. Go to: https://www.office.com/signin, and sign in with the username and password you use with your work or school account.

    Notes: 

  2. Select OneDrive.

  3. Select the file you want to download, and then select Download.

    Screenshot of downloading a blocked file in OneDrive for Business

Why is a file in SharePoint, OneDrive, or Microsoft Teams blocked?

The file is blocked to help protect you, your computer, and your organization from malware.

Certain safety features are in place in Microsoft 365 such that a malicious file can be identified in SharePoint in Microsoft 365, OneDrive for work or school, or Microsoft Teams. If a file in SharePoint, OneDrive, or Microsoft Teams is deemed malicious, that file is blocked so that no one can open it. A blocked file has a marker after its file name, like this:

Screenshot of a file in OneDrive for Business detected as malicious

Although it can be inconvenient for a file to be blocked, getting infected with malware is even worse. Cybercriminals use ransomware, technical support scams, or unwanted software to compromise users and computers. Once cybercriminals get access to user credentials or sensitive information, they can use that information to gain access to more information or other users, or even charge fraudulent fees. To learn more, see Understand the different malware types.

What can I do to avoid running into malicious files in the future?

Although cybercriminals continue to find new ways to trick people with malware, there are steps you can take to help protect you and your computer.

To learn more about how malware works and how to prevent malware infection, see Help prevent malware infection on your PC.

What do I do if I think the system made a mistake?

If your organization uses Microsoft Defender for Office 365 and a file is blocked that you think should not be, you'll need some help from a Microsoft 365 administrator who can research the issue and, potentially, unblock the file. To learn more about what Microsoft 365 administrators do, see About Microsoft 365 admin roles.

Learn more

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.