SharePoint Block Infected Files Download
This policy blocks users from downloading files in SharePoint and OneDrive that have been identified as infected with malware. It helps prevent the spread of malicious files within your organization and protects users from inadvertently accessing harmful content.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Infected file downloads blocked | Prevents users from downloading files that are identified as infected with malware. Learn more |
Configure it
This baseline blocks downloads of files SharePoint has flagged as infected, across SharePoint and OneDrive for the whole tenant.
-
Add the baseline to the tenant (Adding a baseline), or deploy it to many tenants at once as part of a scheme (Deploying a scheme).
-
Leave Infected file downloads blocked on. By default, a user who tries to download a file SharePoint has flagged as infected only sees a warning and can choose to continue anyway; this removes that choice for users and admins alike.
-
There’s no admin centre toggle for this setting; Octiga sets it through SharePoint Online PowerShell for you.
-
Save. Turn on Auto-remediation and Octiga switches this back on automatically if it’s turned off in Microsoft 365.
Check it worked
Passing means SharePoint Online’s infected-file download block reports as enabled. There’s no admin centre page for it, so use SharePoint Online PowerShell to see the setting directly. The effect shows up in behaviour instead: a user opening a file already flagged as malware sees it blocked outright, with no “download anyway” option. A SharePoint Administrator or Global Administrator can still extract a flagged file for investigation using PowerShell.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.