Forum Discussion

Microsoft

Apr 15, 2020

Block download in Teams (Windows 10 application)

Hello, Is there a way to block data exfiltration (e.g. block download) to Windows 10 Microsoft Teams application (not the web version) in a real time protection manner? Since Intune MAM policie...

Block sensitive data file downloads onto personal desktops

Cloud App Security

microsoft teams

rajatm

Former Employee

Apr 20, 2020

MCAS cannot enforce session policies on desktop/native apps. Session policies and controls (including block downloads) are limited to browser sessions only. This is documented at: https://docs.microsoft.com/en-us/cloud-app-security/session-policy-aad

For native/desktop apps, MCAS can allow or block access completely using a CAS Access policy but this does not allow granular control over activities.

A typical implementation in a scenario where one wants to limit downloading of files for users on non-compliant or non-hybrid joined machines, is to have a CA policy in AAD conditional access to forward sessions to CAS (using the 'use custom policy' option) and a CAS access policy to block desktop/native apps (and force users to web-apps) and a CAS session policy to block/control downloads in these web-app sessions.