- Hardeep Bains
Office 365 - Prevent downloading attachments via Outlook Web App
There will be times when you may not want your users to be able to download attachments when they are using Office 365 Outlook Web App. This is especially true if you allow users to connect to Office 365 from their personal computers and attachments are sensitive in nature
You can prevent users downloading attachments via Office 365 OWA with the GUI or PowerShell
Configure 'Prevent downloading attachments' via the GUI
Login in to your Office 365 tenant and open the Exchange Admin Console
Navigate to Permissions on the left hand side and select the Outlook Web App policies tab
Click on the + sign and create a new policy. In this example we have called it OwaPreventAttachmentsDownload
Select the relevant options and hit save. In our example we selected everything. At the bottom of the list you will see some options for Direct file access. If you untick these options, it will take away the download option from attachments and only allow you to view them online only
Now we need to assign the newly created policy to a user
Navigate to Recipients, open up a users properties and click on View Details under Email Connectivity
Now click on Browse, select the OwaPreventAttachmentsDownload policy, click OK and then Save to assign the policy to the user
You can now try downloading an attachment via OWA. You should find that you can View Only
Configure 'Prevent users downloading attachments' via PowerShell:
Connect PowerShell to your Office 365 Exchange Online tenant and run the following command:
Get-OwaMailboxPolicy OwaPreventAttachmentsDownload | fl
This will return a lot of information but the 2 lines we are interested in are:
DirectFileAccessOnPublicComputersEnabled : True DirectFileAccessOnPrivateComputersEnabled : True
Now to set the policy to prevent the downloading of attachments, run the following command:
Set-OwaMailboxPolicy -Identity OwaPreventAttachmentsDownload -DirectFileAccessOnPrivateComputersEnabled $false -DirectFileAccessOnPublicComputersEnabled $false
You should see the same behaviour in that you can only view an attachment
And That Is It !!