If you've received a message that says that your administrator, or your organization, requires a "cloud security scan" of this item, or that Microsoft Defender Antivirus needs to perform a cloud security scan, this is because your system is configured to use Cloud-delivered protection and Automatic sample submission, and you've just opened a file that could be dangerous.
The Microsoft Defender cloud service is going to take a quick look at the file and confirm that it's safe before allowing it to proceed. This usually doesn't take very long.
Why does a file get flagged for this process?
Files that get pulled aside for this extra screening are unfamiliar apps, programs, scripts, or macros that came from the Internet.
For more information about managing Microsoft Defender Antivirus see Virus & threat protection in Windows Security.
See also
For admins: Turn on block at first sight
