What to do when a malicious file is found in SharePoint Online, OneDrive, or Microsoft Teams

You've come across a file in SharePoint Online, OneDrive for Business, or Microsoft Teams, but you're unable to open or share it. You can see the file is there, but it's blocked and the file has a warning icon next to it:

Screenshot of files in OneDrive for Business with one detected as malicious

Delete the file (recommended)

To protect yourself, your computer, and your organization, the best option is to delete the file. From the OneDrive mobile app, your only option is to delete the file.

  1. Select the file you want to delete (on the mobile app, press and hold to select it).

  2. Select Delete.

    Screenshot of deleting a blocked file from OneDrive for Business from the OneDrive mobile app

    Deleting in the OneDrive mobile app

Download the file (if your organization allows it)

If your organization allows it, you can download the file by viewing your OneDrive in a web browser. You can then clean the file by whatever means your organization recommends.

  1. Go to: https://www.office.com/signin, and sign in with the username and password you use with your work or school account.

    Notes: 

  2. Select OneDrive.

  3. Select the file you want to download, and then select Download.

    Screenshot of downloading a blocked file in OneDrive for Business

Why is a file in SharePoint, OneDrive, or Microsoft Teams blocked?

The file is blocked to help protect you, your computer, and your organization from malware.

Certain safety features are in place in Office 365 such that a malicious file can be identified in SharePoint Online, OneDrive for Business, or Microsoft Teams. If a file in SharePoint, OneDrive, or Microsoft Teams is deemed malicious, that file is blocked so that no one can open it. A blocked file has a marker after its file name, like this:

Screenshot of a file in OneDrive for Business detected as malicious

Although it can be inconvenient for a file to be blocked, getting infected with malware is even worse. Cybercriminals use ransomware, technical support scams, or unwanted software to compromise users and computers. Once cybercriminals get access to user credentials or sensitive information, they can use that information to gain access to more information or other users, or even charge fraudulent fees. To learn more, see Understand the different malware types.

What can I do to avoid running into malicious files in the future?

Although cybercriminals continue to find new ways to trick people with malware, there are steps you can take to help protect you and your computer.

To learn more about how malware works and how to prevent malware infection, see Help prevent malware infection on your PC.

What do I do if I think the system made a mistake?

If a file is blocked that you think should not be, you will need some help from an Office 365 administrator who can research the issue and, potentially, unblock the file. To learn more about what Office 365 administrators do, see About Office 365 admin roles.

See Also

Office 365 ATP for SharePoint, OneDrive, and Microsoft Teams

Protect your account and devices from hackers and malware

Expand your Office skills
Explore training
Get new features first
Join Office Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×