SharePoint / SharePoint/sp-dev-docs
Windows Defender blocks Connect-SPOService, False positive? Detected: Trojan:Script/Wacatac.H!ml
Open
@Ashlesha-MSFT is already working on this.
Since May 4, 2026.
Needs: Author Feedback
sharepoint-developer-support
type:bug-suspected
- Dominant language
- PowerShell
- Stars
- 1.4k
- Forks
- 1.1k
- Avg merge
- 4d 12h
- Merged PRs (30d)
- 12
Description
Target SharePoint environment
SharePoint Online
What SharePoint development model, framework, SDK or API is this about?
SharePoint REST API
Developer environment
Windows
What browser(s) / client(s) have you tested
- 💥 Internet Explorer
- 💥 Microsoft Edge
- 💥 Google Chrome
- 💥 FireFox
- 💥 Safari
- mobile (iOS/iPadOS)
- mobile (Android)
- not applicable
- other (enter in the "Additional environment details" area below)
Additional environment details
Multi-Geo, SharePoint site is in France.
Describe the bug / error
When connecting to the sharepoint admin site using Connect-SPOService, Defender flags it as a Trojan.
Multi-Geo, this site is in France.
$AdminSite = "https://Contosofra-admin.sharepoint.com/"
Connect-SPOService -Url $adminSite
Steps to reproduce
- Run Connect-SPOService
- Login with Account
- Receive this error message
- Select Yes
- Defender blocks it as a Trojan
Expected behavior
Successfully log into Sharepoint
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.