# SharePoint Block Infected Files Download

> This policy blocks users from downloading files in SharePoint and OneDrive that have been identified as infected with malware.

This policy blocks users from downloading files in SharePoint and OneDrive that have been identified as infected with malware. It helps prevent the spread of malicious files within your organization and protects users from inadvertently accessing harmful content.

## Settings this baseline controls

| Setting                         | What it does                                                                                                                                                                                             |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Infected file downloads blocked | Prevents users from downloading files that are identified as infected with malware. [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline blocks downloads of files SharePoint has flagged as infected, across SharePoint
and OneDrive for the whole tenant.

1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to many
   tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Leave **Infected file downloads blocked** on. By default, a user who tries to download a file
   SharePoint has flagged as infected only sees a warning and can choose to continue anyway;
   this removes that choice for users and admins alike.
3. There's no admin centre toggle for this setting; Octiga sets it through SharePoint Online
   PowerShell for you.
4. Save. Turn on **Auto-remediation** and Octiga switches this back on automatically if it's turned
   off in Microsoft 365.

> **Licence: Defender for Office 365:**

## Check it worked

**Passing** means SharePoint Online's infected-file download block reports as enabled. There's
no admin centre page for it, so use SharePoint Online PowerShell to see the setting directly.
The effect shows up in behaviour instead: a user opening a file already flagged as malware sees
it blocked outright, with no "download anyway" option. A SharePoint Administrator or Global
Administrator can still extract a flagged file for investigation using PowerShell.

## Standards this addresses

### CIS

- **M365 7.3.1** — CIS M365 Foundations Benchmark 7.3.1
- **v8 10.1** — CIS Controls v8 Safeguard 10.1

### NIST

- **PR.DS-4** — NIST CSF 2.0 PR.DS-4
- **SI-3** — NIST SP 800-53 SI-3
- **SC-7** — NIST SP 800-53 SC-7

### ISO 27001

- **A.8.7** — ISO/IEC 27001:2022 Annex A.8.7
- **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)