Disable Office 365 Products ability to download (MOBILE)

[skylarh]

Hello,

I am trying to disable the ability for people to download files from the Teams / Outlook applications on their mobile devices. 

I selected the Disable Downloads feature from a Conditional Access area shown here, however, while testing on my mobile device, I was able to export the files / download them without any issues. 

[#2]

@skylarh did you create the policy in MDCA as well ? and in your conditional access did you set to include android OS ?

[#3]

@eliekarkafy - I did include Android and iOS in this CA policy. When trying to do the MDCA I get this error unless I am in the wrong section.

[#4]

@skylarh in the app connector in MDCA you have added the M365 app ?

[#5]

you dont need to create a policy from here the CA that you create will communicate with MDCA to protect your targetted app

[#6]

@eliekarkafy - Shown here, it is added. 

[#7]

try from a browser using the mobile device and not from the app itself

[#8]

@eliekarkafy - Same issue, I was able to download from outlook.com

[#9]

your user is licensed with the P1 License ?

[#10]

Our tenant has an E5 license assigned with an Entra ID P2 assigned.

I have gone ahead and assigned myself an Azure Information Protection Premium P1 license to see if that will change it.

[#11]

the E5 inlcudes all the license required for your setup , please try with the same user using an Edge browser in your machine and see if it block you

[#12]

So it worked on a browser-based version, however, the apps do not work. We would need to find a way for it to cascade down to the applications.

[#13]

MDCA session controls are built to work with any browser only such as chrome and edge through the reverse proxy. if you want to manage the apps on mobile devices you can use the app protection policy in Intune with allows you to bloc downloads

https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy

[#14]

@eliekarkafy I can't really find what I am looking for in Intune. Would you know the policy for it? All of these devices are not managed.  

[#15]

even if the devices are not managed you can control the outlook application by targeting the users

https://github.com/MicrosoftDocs/memdocs/blob/main/memdocs/intune/protect/tutorial-protect-email-on-...

[#16]

Are these mobile devices managed in Intune, or are these devices unknown in the environment? If so, you can also use mandatory compliancy in combination with app enforced restrictions. (https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices)

[#17]

@JosvanderVaart - These are devices unknown to the company, all personal cell phones. 

I have assigned myself the E5 license as it has intune on it, and it didn't restrict me. For our workflow to keep it most efficient, our employees need to have access to teams on their phones for quick responses. 

[#18]

Thanks for this, I'll take a further look at it.