I am connecting to a SharePoint Online tenancy and interrogating a document library using CSOM. Is it possible to determine in code whether or not the anti-malware scan (which I know runs asynchronously) has finished scanning the file from the library that I'm interested in? I know that using the old sharepoint API you could interrogate an SPFile and see the SPVirusCheckStatus, but I can't see anything similar in CSOM.

1 Answer 1


In the absence of a better answer, I am inspecting the value of the _VirusStatus field. If the file has been scanned it will have a value in this field.

Possible values (from the MS documentation):

  • case "0": // No Virus detected
  • case "1": // Virus reported by the scanner plugin but not yet determined if removal possible.
  • case "2": // Virus reported by the scanner plugin which can be removed.
  • case "3": // Virus successfully removed
  • case "4": // Virus reported, attempted clean failed.
  • case "5": // Virus reported, document should be deleted.
  • case "6": // Timeout last scan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.