Prevent Downloading of Enclosures

Allowing users to download email attachments to personal or unmanaged devices significantly increases the risk of sensitive information leaving the organization's control. Restricting attachment downloads is an effective data protection measure, especially for organizations using Microsoft 365, Exchange Online, and Outlook on the web.

Why it matters

• Reduces the risk of sensitive documents being copied to unmanaged devices.
• Helps prevent accidental or intentional data exfiltration.
• Supports Zero Trust and data protection initiatives.
• Improves compliance with regulatory and internal security requirements.

Implementation steps

• Identify users or groups that require download restrictions.
• Use Microsoft Purview or Conditional Access App Control to block attachment downloads on unmanaged devices.
• Configure Outlook on the web to allow viewing attachments without permitting downloads where appropriate.
• Apply Conditional Access policies to distinguish between compliant and non-compliant devices.
• Test the policy with a pilot group before organization-wide deployment.
• Monitor audit logs and user feedback after implementation.

Best practices

• Allow downloads only from compliant and managed devices.
• Combine download restrictions with sensitivity labels and Data Loss Prevention (DLP) policies.
• Regularly review policy exceptions.
• Educate users about why download restrictions are in place.

Related hardening guidance:

• Block Legacy Authentication
• Enable Multi-Factor Authentication (MFA)
• Configure Data Loss Prevention (DLP) Policies