Can you restrict downloading from Teams?

[Chris Brooks]

I would like to create a 'Any device, anywhere' conditional access policy where by if you are using a corporate domain joined computer it will let you access and download o365 files BUT if you are on a personal device e.g. home computer or public computer it will restrict downloads.  

I've created the policies needed using the [SharePoint Admin center] conditional access polices in Intune and initially I thought they worked great.  If I was on public computer it allowed me to access and edit OneDrive and SharePoint files within the web browser and if I tried to download them locally it wouldn't let me! Great!  However, I've spotted a loophole.  You can get around this by opening these files through Teams as the conditional access policy doesn't seem to apply to Microsoft Teams!  Anyone else spotted this or know a workaround or fix for this? 

[#2]

Not sure if you can get Teams to work, however if it works with SharePoint it will work in Teams soon when they replace the Files tab with SharePoint Modern Library UI. So it might be a matter of waiting for that release. No idea when that is coming but it should be by year end worse case, but it could be any week.

Go to Teams files tab, and click "Open in SharePoint", then try to see if it works from the attached Team SharePoint site. If it does, then the files tab release should fix your issue. Otherwise if it doesn't, then your settings aren't applying to the underlying SharePoint site the teams are attached to and I would check there!

[#3]

I've been digging through CA and Intune policies, still no luck on this one.  Am I missing something simple?

[#4]

this works for me: https://docs.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices?redirectSourcePath...

[#5]

@Tommek Does that allow your users to launch the Teams client on an unmanaged devices, but prevent them from using Teams to download files from SPO / OneDrive?  I'm not seeing that behavior here.

[#6]

@David Phillips no it doesn't allow users using Team client anymore. you can chose between no acces or only Webaccess from unmanaged devices...

if you would like to use teams client I think than you need to use CA and Cloud APP Security https://docs.microsoft.com/en-us/cloud-app-security/use-case-proxy-block-session-aad