Troubleshooting Tip: FortiClient AntiVirus Protection notification pop-up when 'automatic file download' is triggered by OneDrive

When [Real-Time Protection] is enabled in the Malware Protection profile, and when OneDrive is configured to always in-sync with the online folder, the user will receive the following pop-up message whenever there is a new file uploaded to OneDrive:

This is expected behavior.

If this behavior is not desired, apply one of the following options:

1. If OneDrive 'always-in-sync' and FortiClient [Real-Time Protection] are both required for the organization, this behavior is expected. FortiClient scans the file as it is being downloaded, making this completely normal. There is no operational impact.
2. If OneDrive 'always-in-sync' is not required, follow the steps in the following Microsoft Guides to enable 'Files On-Demand':

• Microsoft Guide - Enable 'Files-On-Demand'
• Microsoft Guide - Stop sync in OneDrive
  

3. If OneDrive 'always-in-sync' is required, go to FortiClient EMS -> Endpoint Profiles -> Malware Protection -> (select the profile) -> Edit -> toggle [Real-Time Protection] to OFF -> Save.

Note: This completely disables the real-time protection feature in FortiClient Malware Protection.