You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn about how SharePoint detects viruses in files that users upload and prevents users from downloading or syncing the files.
19
+
description: Learn about how SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams detect viruses in uploaded files and prevent users from downloading or syncing the files.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
26
+
26
27
---
27
28
28
-
# Built-in virus protection in SharePoint, OneDrive, and Microsoft Teams
29
+
# Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams
Microsoft 365 uses a common virus detection engine for scanning files that users upload to SharePoint, OneDrive, and Microsoft Teams. This protection is included with all subscriptions that include SharePoint, OneDrive, and Microsoft Teams.
33
+
Microsoft 365 uses a common virus detection engine for scanning files that users upload to SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams. This protection is included with all subscriptions that include SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams.
33
34
34
35
> [!IMPORTANT]
35
36
> The built-in anti-virus capabilities are a way to help contain viruses. They aren't intended as a single point of defense against malware for your environment. We encourage all customers to investigate and implement anti-malware protection at various layers and apply best practices for securing their enterprise infrastructure.
36
37
37
-
## What happens if an infected file is uploaded to SharePoint?
38
+
## What happens if an infected file is uploaded to SharePoint, SharePoint Embedded, OneDrive, or from Microsoft Teams?
38
39
39
-
The Microsoft 365 virus detection engine scans files asynchronously (at some time after upload). If a user tries to download a file in a web browser or from Teams that hasn't been scanned, a scan is triggered before the download is allowed. **All file types are not automatically scanned**. Heuristics determine the files to scan. When a file is found to contain a virus, the file is flagged.
40
+
The Microsoft 365 virus detection engine scans files asynchronously (at some time after upload). If a user tries to download a file in a web browser or from Microsoft Teams that hasn't been scanned, a scan is triggered before the download is allowed. **All files are not automatically scanned**. Anti-malware heuristics determine the files to scan. When a file is found to contain a virus, the file is flagged as containing malware.
40
41
41
42
Here's what happens:
42
43
43
-
1. A user uploads a file to SharePoint.
44
-
2. SharePoint, as part of its virus scanning processes, later determines if the file meets the criteria for a scan.
44
+
1. A user uploads a file to SharePoint, SharePoint Embedded, OneDrive, or from Microsoft Teams.
45
+
2. SharePoint using the common Microsoft 365 anti-malware engine, as part of its virus scanning processes, later determines if the file meets the criteria for a scan.
45
46
3. If the file meets the criteria for a scan, the virus detection engine scans the file.
46
47
4. If a virus is found within the scanned file, the virus engine sets a property on the file that indicates the file is infected.
47
48
48
-
## What happens when a user tries to download an infected file by using the browser?
49
+
## What happens when a user tries to download an infected file by using their web browser?
49
50
50
-
By default, users can download infected files from SharePoint. Here's what happens:
51
+
By default, users can download infected files from SharePoint or OneDrive. Here's what happens:
51
52
52
-
1. In a web browser, a user tries to download a file from SharePoint that happens to be infected.
53
+
1. In a web browser, a user tries to download a file from SharePoint or OneDrive that happens to be infected.
53
54
2. The user is shown a warning that a virus was detected in the file. The user is given the option to proceed with the download and attempt to clean it using anti-virus software on their device.
54
55
55
-
To change this behavior so users can't download infected files, even from the anti-virus warning window, admins can use the *DisallowInfectedFileDownload* parameter on the **[Set-SPOTenant](/powershell/module/sharepoint-online/Set-SPOTenant)** cmdlet in SharePoint Online PowerShell. The value $true for the *DisallowInfectedFileDownload* parameter completely blocks access to detected/blocked files for users.
56
+
To change this behavior so users can't download infected files from SharePoint or OneDrive, even from the anti-virus warning window, admins can use the *DisallowInfectedFileDownload* parameter on the **[Set-SPOTenant](/powershell/module/sharepoint-online/Set-SPOTenant)** cmdlet in SharePoint Online PowerShell. The value $true for the *DisallowInfectedFileDownload* parameter completely blocks access to detected/blocked files for users.
56
57
57
58
For instructions, see [Use SharePoint Online PowerShell to prevent users from downloading malicious files](safe-attachments-for-spo-odfb-teams-configure.md#step-2-recommended-use-sharepoint-online-powershell-to-prevent-users-from-downloading-malicious-files).
58
59
59
-
## Can admins bypass *DisallowInfectedFileDownload* and extract infected files?
60
+
## Can admins bypass *DisallowInfectedFileDownload* and extract infected files from SharePoint or OneDrive?
60
61
61
-
SharePoint admins and global admins<sup>\*</sup> are allowed to do forensic file extractions of malware-infected files in SharePoint Online PowerShell with the [Get-SPOMalwareFileContent](/powershell/module/sharepoint-online/get-spomalwarefilecontent) cmdlet. Admins don't need access to the site that hosts the infected content. As long as the file is marked as malware, admins can use **Get-SPOMalwareFileContent** to extract the file.
62
+
Members of the SharePoint Administrator or Global Administrator roles in Microsoft Entra ID<sup>\*</sup> are allowed to do forensic file extractions of malware-infected files from SharePoint Online PowerShell with the [Get-SPOMalwareFileContent](/powershell/module/sharepoint-online/get-spomalwarefilecontent) cmdlet. Admins don't need access to the site that hosts the infected content. As long as the file is marked as malware, admins can use **Get-SPOMalwareFileContent** to extract the file.
62
63
63
64
For more information about the infected file, admins can use the **[Get-SPOMalwareFile](/powershell/module/sharepoint-online/get-spomalwarefile)** cmdlet to see the type of malware that was detected and the status of the infection.
64
65
65
66
> [!IMPORTANT]
66
67
> <sup>\*</sup> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
67
68
68
-
## What happens when the OneDrive sync client tries to sync an infected file?
69
+
## What happens when the OneDrive sync client tries to sync an infected file from SharePoint or OneDrive?
69
70
70
-
When a malicious file is uploaded to OneDrive, the file is synced to the local machine before being marked as malware. After the file is marked as malware, the user can't open the synced file from their local machine.
71
+
When a malicious file is uploaded to SharePoint or OneDrive, the file might be synced to the local machine before being marked as malware. After the file is marked as malware, the user can't open the synced file from their local machine.
71
72
72
73
## Extended capabilities with Microsoft Defender for Office 365
73
74
74
-
Microsoft 365 organizations that have [Microsoft Defender for Office 365](mdo-about.md) included in their subscription or purchased as an add-on can enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams for enhanced reporting and protection. For more information, see [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md).
75
+
Microsoft 365 organizations that have [Microsoft Defender for Office 365](mdo-about.md) included in their subscription or purchased as an add-on can enable Safe Attachments for SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams for enhanced reporting and protection. For more information, see [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md).
75
76
76
77
## Related articles
77
78
78
79
[Malware and ransomware protection in Microsoft 365](/compliance/assurance/assurance-malware-and-ransomware-protection)
79
80
80
-
[Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-configure.md).
81
+
[Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](/safe-attachments-for-spo-odfb-teams-configure.md)
82
+
83
+
[Introduction to SharePoint and OneDrive in Microsoft 365 for administrators](/sharepoint/introduction)
84
+
85
+
[Overview of SharePoint Embedded](/sharepoint/dev/embedded/overview)
0 commit comments