Account holders file share notifications are being flagged as malware

Question

Account holders file share notifications are being flagged as malware

Academy for Urban Scholars 0

When a user shares a file with another user in our tenant the notifcation is being quarantined as malware and the receipient is not getting notified of the file share through outlook. The file is accessible through onedrive and is deemed as a shared file, however the notification is not going through.

0 comments

1 answer

Your answer

Answer 1

Dear @Academy for Urban Scholars

First, identify where the block is happening

Check your mail flow rules/filtering:
- Go to Exchange Admin Center -> Mail flow ->Rules
- Look for any rules that might be blocking emails with certain keywords like "shared a file" or "OneDrive"
- Check if any rules are set to quarantine or redirect notifications
- Disable or modify any overly aggressive rules
Check your third-party email filtering (if you use it):
- Proofpoint, Mimecast, Sophos, etc. sometimes flag share notifications
- Contact your email security vendor and ask them to whitelist share notification emails from Microsoft
- Usually comes from addresses like ******@sharepointems.com or your tenant's notification addresses
Check Microsoft Defender for Office 365 (if enabled):
- Exchange Admin Center → Threat policies → Safe Links / Safe Attachments
- Verify share notifications aren't being blocked there
- You might need to add the OneDrive/SharePoint notification domain to your allow list

https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules

Also you can check your audit logs to confirm the share actually happened:

Audit log search in Microsoft 365: https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-log-search
How to search the unified audit log: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance

Let me know if you have any further doubts or queries.

Thanks