If you've received a message that says that your administrator, or your organization, requires a "cloud security scan" of this item, or that Microsoft Defender Antivirus needs to perform a cloud security scan, this is because your system is configured to use Cloud-delivered protection and Automatic sample submission, and you've just opened a file that could be dangerous.

The Microsoft Defender cloud service is going to take a quick look at the file and confirm that it's safe before allowing it to proceed. This usually doesn't take very long. 

Why does a file get flagged for this process?

Files that get pulled aside for this extra screening are unfamiliar apps, programs, scripts, or macros that came from the Internet. 

For more information about managing Microsoft Defender Antivirus see Virus & threat protection in Windows Security.

See also

For admins: Turn on block at first sight

Microsoft security help and learning

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

What affected your experience?

Any additional feedback? (Optional)

Thank you for your feedback!