'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Block Microsoft 365 Web App Downloads with Defender or Purview
Question details
Administrators need a way to prevent users from downloading copies of files from Microsoft 365 web applications on unmanaged devices.
- Product
- Microsoft 365 Web Apps
- Device & OS
- not provided
- Scenario
- Securing company data by applying strict download restrictions to web-based Office applications when accessed from devices not managed by the organization.
- Observed behavior
- Organizations need different data protection controls for Word and Excel web apps compared to Outlook to successfully block the 'Download as Copy' feature.
Ensure you have global administrator or security administrator privileges in your Microsoft 365 tenant, and verify that your organization is licensed for Microsoft Defender for Cloud Apps or Microsoft Purview.
Use Microsoft Defender for Cloud Apps Session Policies
Configure session policies in Defender for Cloud Apps to monitor and restrict file downloads in real-time based on the device's management status.
Microsoft Defender for Cloud Apps provides granular control over user sessions. By leveraging Conditional Access App Control, you can enforce policies that specifically block downloads from Word, Excel, and other Microsoft 365 web apps when accessed from unmanaged devices.
Log in to the Microsoft Defender portal as an administrator and navigate to 'Cloud Apps' > 'Policies' > 'Policy management'.
Click 'Create policy' and select 'Session policy'. Choose 'Control file download (with inspection)' from the policy template dropdown.
In the 'Activity source' section, add a filter for 'Device Tag' and set it to 'does not equal' 'Intune compliant' or 'Hybrid Azure AD joined' to target unmanaged devices.
Under the 'Actions' section, select 'Block' and customize the block message that users will see when they attempt to download a file. Save and enable the policy.
Apply Data Loss Prevention (DLP) Policies via Microsoft Purview
Use Microsoft Purview to create DLP rules that prevent the sharing or downloading of sensitive information from SharePoint and OneDrive.
Secure Your Documents Locally with WPS Office
Managing complex cloud policies in Microsoft 365 can be overwhelming. WPS Office provides a highly secure, lightweight, and offline-capable alternative with built-in document encryption, ensuring your data stays protected without requiring complicated tenant configurations.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen instructions to set up the suite on your device.
- 3. Apply Document Passwords: Open any document, go to 'Menu' > 'Document Encryption', and set a password to securely restrict editing or extracting data.
Frequently Asked Questions
Why do Word and Excel web apps require different controls than Outlook on the web?
Outlook on the web relies on Exchange Online policies, such as Outlook Web App (OWA) mailbox policies, to restrict attachment downloads. Word and Excel web apps, however, interface directly with SharePoint Online and OneDrive, requiring Defender for Cloud Apps or Purview for granular, file-level download restrictions.
Can users still view documents online if 'Download as Copy' is blocked?
Yes. When configured correctly using Defender for Cloud Apps session policies, users on unmanaged devices can still open, view, and edit documents directly within the browser without having the ability to download a local copy.
Can I apply these download restrictions to specific user groups only?
Absolutely. Both Microsoft Defender for Cloud Apps and Microsoft Purview allow you to scope your policies to specific Azure AD users or groups, ensuring that restrictions only apply to intended departments or external contractors.
Will blocking downloads affect users on managed company devices?
No, provided you configure the device filters correctly. By setting the policy to target only devices that are not 'Intune compliant' or 'Hybrid Azure AD joined', users on managed company devices will retain full download capabilities.
