none
Disable attachments in OWA RRS feed

  • Question

  • Hello all, so here is my situation:

    I work for a health record review company that handles extremely sensitive data. I've been tasked with finding a solution for preventing attachments from being downloaded from OWA. While blocking the attachments in OWA, they would be available if the user used his/her outlook client within the company network or accessed the company network via our VPN. This policy would be  particularly helpful with mobile devices and tablets. I've searched all over the internet but can find no solution to do what I'm being tasked with. Does anyone have an idea? 

    Monday, November 25, 2019 9:44 PM

Answers

  • Hi,

    Do you mean that you want to prevent all users to download attachments from OWA? And do not allow users to preview attachments from OWA too?

    If you only want to prevent several specified users to download and preview attachments from OWA, you can create a owa mailbox policy and apply with the following commands:

    New-OwaMailboxPolicy -Name <policy name> -DirectFileAccessOnPrivateComputersEnabled $false -DirectFileAccessOnPublicComputersEnabled $false

    Set-CasMailbox -Identity <MailboxIdentity> -OwaMailboxPolicy <Policy Name>



    If you want to prevent all users to download and preview attachments from OWA, you can use the following command and then restart IIS:

    Set-OwaVirtualDirectory -Identity <server name\owa (default Web site)> -DirectFileAccessOnPrivateComputersEnabled $false -DirectFileAccessOnPublicComputersEnabled $false


    Note that Office and .pdf documents can still be previewed in OWA.

    You can learn more information about the parameters from Set-OwaMailboxPolicy, Set-OwaVirtualDirectory.

    Regards,

    Vera Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.



    Tuesday, November 26, 2019 8:50 AM

All replies

  • Hi

    Try this command to prevent attachment downloads:

    Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -DirectFileAccessOnPublicComputersEnabled $false -DirectFileAccessOnPrivateComputersEnabled $false

    Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Tuesday, November 26, 2019 6:52 AM
    Owner
  • Hi,

    Do you mean that you want to prevent all users to download attachments from OWA? And do not allow users to preview attachments from OWA too?

    If you only want to prevent several specified users to download and preview attachments from OWA, you can create a owa mailbox policy and apply with the following commands:

    New-OwaMailboxPolicy -Name <policy name> -DirectFileAccessOnPrivateComputersEnabled $false -DirectFileAccessOnPublicComputersEnabled $false

    Set-CasMailbox -Identity <MailboxIdentity> -OwaMailboxPolicy <Policy Name>



    If you want to prevent all users to download and preview attachments from OWA, you can use the following command and then restart IIS:

    Set-OwaVirtualDirectory -Identity <server name\owa (default Web site)> -DirectFileAccessOnPrivateComputersEnabled $false -DirectFileAccessOnPublicComputersEnabled $false


    Note that Office and .pdf documents can still be previewed in OWA.

    You can learn more information about the parameters from Set-OwaMailboxPolicy, Set-OwaVirtualDirectory.

    Regards,

    Vera Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.



    Tuesday, November 26, 2019 8:50 AM
  • I would like to test this on a group of test users before I implement it in the production environment. What would the PS command be for that?
    Wednesday, November 27, 2019 4:32 PM
  • Hi,

    You can run the commands I referred above in EMS of local server. Or you can use remote PowerShell to connect to the Exchange server, then run these commands. 
    For more details, please refer to Connect to Exchange servers using remote PowerShell.

    Regards,

    Vera Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Tuesday, December 3, 2019 2:30 AM
  • Any updates so far? If you have got your expectations, could you share with us? Maybe it will help more people with similar requirements.

    Regards,

    Vera Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Friday, December 6, 2019 11:51 AM
  • Any updates so far? If you have got your expectations, could you share with us? Maybe it will help more people with similar requirements.

    Regards,

    Vera Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Hello Vera,

    I'll be utilizing some of the methods listed here. I'm also looking into a 3rd party app that may do what I need. Thanks to everyone for their help.

    Friday, December 6, 2019 12:43 PM
  • I'm glad you got help on this problem. The following is a brief summary of this request so that others may get help from here.

    Requests
    ==========================================
    Find a solution for preventing attachments from being downloaded from OWA. While blocking the attachments in OWA, they would be available if the user used outlook client within the company network or accessed the company network via our VPN.

    Suggestions
    ==========================================
    If you only want to prevent several specified users to download and preview attachments from OWA, you can create a owa mailbox policy and apply with the following commands:

    New-OwaMailboxPolicy -Name <policy name> -DirectFileAccessOnPrivateComputersEnabled $false -DirectFileAccessOnPublicComputersEnabled $false
    
    Set-CasMailbox -Identity <MailboxIdentity> -OwaMailboxPolicy <Policy Name>


    If you want to prevent all users to download and preview attachments from OWA, you can use the following command and then restart IIS:

    Set-OwaVirtualDirectory -Identity <server name\owa (default Web site)> -DirectFileAccessOnPrivateComputersEnabled $false -DirectFileAccessOnPublicComputersEnabled $false


    Note that Office and .pdf documents can still be previewed in OWA.

    Reference links
    ==========================================
    Set-OwaMailboxPolicy
    Set-OwaVirtualDirectory


    Regards,

    Vera Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, December 9, 2019 11:14 AM