File or Access policy to restrict file downloads

Question

Hello,We have multiple web applications that are built to be accessible outside of our corporate network.&nbsp; Some of the important features are to be able to generate PDFs and print.&nbsp;Is there a way to setup file or access policies that will restrict file downloads and temporary files to be only saved to corporate OneDrive or SharePoint?&nbsp;This is possible on Office Web Applications and Intune using MAM.&nbsp; Can this be done for Custom applications using MCAS?

fananico · Answer

JamesRV&nbsp;&nbsp;Hi,&nbsp;The only policies that are active in real time are access and session policies.&nbsp;Session policies will give you control over download and other activities but it cannot redirect downloaded Files to OneDrive.&nbsp;Could you explain the goal of the redirection?&nbsp;If it is security related, you can label the files as they are downloaded via information protection labels and set permission as to which activities can be performed on the file once it is downloaded.&nbsp;The files are encrypted in the same manner as application protection in intune.&nbsp;Thx,&nbsp;Shlomi&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

jamesrv · Answer

Fananico&nbsp;Thank you for the response.&nbsp; The need is; Data Loss Prevention. Looks like automatic labeling and classification is the way to go.&nbsp; But for some reason my MCAS is having trouble connecting with AIP and so there are NO labels showing up in my policy.&nbsp; I have a ticket open to get this resolved.&nbsp;&nbsp;

fananico · Answer

JamesRV&nbsp;&nbsp;Hi James,&nbsp;followed the steps here :&nbsp;https://docs.microsoft.com/en-us/cloud-app-security/azip-integration&nbsp;make sure to click on grant access.&nbsp;have you published the azure information protection labels?do they appear in office apps?&nbsp;Thx,&nbsp;Shlomi

jamesrv · Answer

Fananico&nbsp;The labels are showing up on all office apps including admin.office.com BUT not on MCAS.&nbsp;The grant permission step keeps going in a loop. Yes I am a GA and have logged in sessions in the browser where I am doing this.&nbsp;&nbsp;

fananico · Answer

JamesRV&nbsp;&nbsp;🙂 i just finished a call with microsoft and have the same looping problem trying to grant MCAS access in azure AD.&nbsp;But i am able to see all the labels and apply them as governance actions to files...&nbsp;&nbsp;&nbsp;&nbsp;

Forum Discussion

File or Access policy to restrict file downloads

5 Replies

Resources