conditional access app control block downloads (preview) applying to mobile and desktop

%3CLINGO-SUB%20id%3D%22lingo-sub-1503452%22%20slang%3D%22en-US%22%3Econditional%20access%20app%20control%20block%20downloads%20(preview)%20applying%20to%20mobile%20and%20desktop%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1503452%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20anyone%20confirm%20if%20applying%26nbsp%3Bconditional%20access%20app%20control%20%22block%20downloads%20(preview)%22%20works%20for%20desktop%20and%20mobile%20or%20whether%20its%20basically%20a%20shortcut%20to%20manually%20setting%20up%20an%20MCAS%20session%20policy%20to%20block%20downloads%20-%20which%20only%20works%20for%20the%20browser.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20specifically%20in%20relation%20to%20Teams%2C%20where%20the%20requirement%20is%20to%20block%20downloads%20for%20mobile%2C%20desktop%20and%20browser.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1503452%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Eblock%20downloads%20(preview)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1503606%22%20slang%3D%22en-US%22%3ERe%3A%20conditional%20access%20app%20control%20block%20downloads%20(preview)%20applying%20to%20mobile%20and%20desktop%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1503606%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F100245%22%20target%3D%22_blank%22%3E%40Chris%20Johnston%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20my%20testing%2C%20i've%20found%20the%20experience%20in%20client%20app%20for%20Teams%20was%20unpredictable.%20I%20was%20able%20to%20get%20it%20working%20with%20the%20Teams%20App%20initially%2C%20but%20then%20it%20seemed%20to%20stop%20working%20without%20me%20making%20any%20changes%20to%20the%20CA%20policy.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20think%20that%20the%20CA%20services%20and%20service%20dependencies%20are%20in%20a%20bit%20of%20a%20transitional%20phase%20just%20now%2C%20with%20Teams%20still%20in%20preview%20for%20example.%20I%20think%20it%20will%20come%2C%20but%20for%20the%20time%20being%2C%20this%20is%20not%20the%20finished%20article.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20not%20done%20any%20testing%20on%20mobile%20devices%20I%20must%20admit.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1505043%22%20slang%3D%22en-US%22%3ERe%3A%20conditional%20access%20app%20control%20block%20downloads%20(preview)%20applying%20to%20mobile%20and%20desktop%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1505043%22%20slang%3D%22en-US%22%3E%3CP%3Ethanks%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F616707%22%20target%3D%22_blank%22%3E%40PeterRising%3C%2FA%3E%20for%20the%20feedback%2C%20hopefully%20someone%20from%20the%20product%20team%20can%20provide%20some%20clarification.%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1511439%22%20slang%3D%22en-US%22%3ERe%3A%20conditional%20access%20app%20control%20block%20downloads%20(preview)%20applying%20to%20mobile%20and%20desktop%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1511439%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F616707%22%20target%3D%22_blank%22%3E%40PeterRising%3C%2FA%3E%26nbsp%3Bdid%20you%20get%20this%20to%20work%20again%3F%20If%20the%20CA%20rule%20is%20set%20to%20custom%20and%20I%20create%20a%20MCAS%20Access%20Policy%20with%20the%20MCAS%20client%20app%20filter%20to%20Mobile%20and%20Desktop%20it%20is%20possible%20to%20leverage%20the%20Teams%20App%20specifically.%20Unfortunately%20the%20access%20policy%20can%20only%20monitor%20or%20block%2C%20and%20not%20block%20downloads%20the%20same%20way%20a%20session%20policy%20can.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1511546%22%20slang%3D%22en-US%22%3ERe%3A%20conditional%20access%20app%20control%20block%20downloads%20(preview)%20applying%20to%20mobile%20and%20desktop%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1511546%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F416325%22%20target%3D%22_blank%22%3E%40CloudLife%3C%2FA%3E%26nbsp%3Bmy%20testing%20for%20mobile%20and%20desktop%20was%20that%20it%20didn't%20work%2C%20which%20prompted%20me%20to%20raise%20it%20on%20this%20forum.%26nbsp%3B%20This%20testing%20was%20a%20couple%20of%20weeks%20ago%20so%20it%20didn't%20appear%20to%20be%20working%20then.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1512139%22%20slang%3D%22en-US%22%3ERe%3A%20conditional%20access%20app%20control%20block%20downloads%20(preview)%20applying%20to%20mobile%20and%20desktop%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1512139%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F416325%22%20target%3D%22_blank%22%3E%40CloudLife%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20not%20had%20the%20opportunity%20to%20test%20further%20yet.%26nbsp%3B%20I%20will%20see%20if%20I%20can%20make%20some%20time%20to%20look%20again%20tomorrow.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Hi,

 

Can anyone confirm if applying conditional access app control "block downloads (preview)" works for desktop and mobile or whether its basically a shortcut to manually setting up an MCAS session policy to block downloads - which only works for the browser. 

 

This is specifically in relation to Teams, where the requirement is to block downloads for mobile, desktop and browser.  

 

 

 

 

 

5 Replies

@Chris Johnston 

 

In my testing, i've found the experience in client app for Teams was unpredictable. I was able to get it working with the Teams App initially, but then it seemed to stop working without me making any changes to the CA policy.

 

I think that the CA services and service dependencies are in a bit of a transitional phase just now, with Teams still in preview for example. I think it will come, but for the time being, this is not the finished article.

 

I've not done any testing on mobile devices I must admit.

thanks @PeterRising for the feedback, hopefully someone from the product team can provide some clarification.   

@PeterRising did you get this to work again? If the CA rule is set to custom and I create a MCAS Access Policy with the MCAS client app filter to Mobile and Desktop it is possible to leverage the Teams App specifically. Unfortunately the access policy can only monitor or block, and not block downloads the same way a session policy can. 

@CloudLife my testing for mobile and desktop was that it didn't work, which prompted me to raise it on this forum.  This testing was a couple of weeks ago so it didn't appear to be working then. 

@CloudLife 

 

I have not had the opportunity to test further yet.  I will see if I can make some time to look again tomorrow.