MC1472591: Outlook Enforces Conditional Access Policies for Attachment Downloads, Previews, and Uploads

📢 Official Microsoft Message Center Announcement

Updated September 23, 2026: We have updated the content. Thank you for your patience. 

[What and why:]

As part of our overall security initiatives, we’ve created a separate internal application configuration for Outlook attachments, therefore, all standard security and authentication flows will be handled separately. Moreover, Conditional Access policies are now enforced for Outlook attachment operations. Users who don’t meet company policies won’t be able to download, preview, or upload classic attachments (this includes inline images). Policies assigned to Exchange and Office cloud applications will be inherited by the attachment application by default. Continuous Access Evaluation is not included in the initial rollout but will follow up soon.

[Rollout schedule:]

Available now.

[Impact on your organization:]

• Your existing policies now cover attachments. Conditional Access policies you have already scoped to Exchange and Office cloud applications will be enforced for attachment scenarios as well. No new policies need to be created.
• Users out of compliance will be blocked from attachments. If a user’s session no longer satisfies a Conditional Access policy — for example, a non-compliant device, a blocked location, or a network change that triggers CAE re-evaluation — attachment operations will be blocked.
• These are separate follow-up changes we expect to land in the upcoming weeks. We’ll keep you updated on the readiness and rollout of these enhancements:
  • User sign in prompt for remediation. We’re currently working on a solution to prompt the user for sign in to recover functionalities when possible. This will depend on the policy configuration; if the user is not compliant, they won’t be able to use attachment-related tasks. We’ll provide an update to customers once we start rolling out this enhancement.
  • Enable Continuous Access Evaluation (CAE). CAE isn’t supported for this new application configuration yet. We’ll update this message with additional content when it becomes available.  

[Action required / Recommendations:]

1. Review how your Office and Exchange policies apply to attachments.
   1. Attachment operations are now handled by their own application, which by default inherits the Conditional Access policies you’ve assigned to Office and Exchange. Confirm those conditions are what you intend to enforce for attachments.
   2. If you’ve intentionally excluded Exchange online from a policy, that exclusion doesn’t carry over to attachments, so users in scope can reach their mail but will be blocked from downloading, previewing, or uploading attachments.
   3. To manage attachment policies separate from mail, you can either exclude the attachment application from a policy or target it in a policy of its own. Both require a one-time setup step in your tenant — see Appendix: Excluding attachments from a policy.
2. Update your help desk documentation. Support staff should know that attachment access failures may now result from a Conditional Access policy, and that the remediation is the same as for Outlook — return to a compliant device or network and re-authenticate.
3. Notify users if you enforce strict Conditional Access policies, so they understand attachment actions may now be blocked under the same conditions that already block access to their mailbox.

[Appendix:]

Excluding attachments from a policy

Attachment operations are handled by an application named OwaDownloadAttachments (application Id: e4f2bb2d-a4d0-4eab-aac6-a8b83471cf64 ). Before you can exclude it from a Conditional Access policy, a service principal for it must exist in your tenant. This is a one-time step you’ll need to complete first.

Step 1: Create the service principal

You’ll need the Cloud Application Administrator or Global Administrator role.

1. Open Graph Explorer and sign in as an administrator of your tenant.
2. Run:

POST https://graph.microsoft.com/v1.0/servicePrincipals

Request body: { “appId”: “e4f2bb2d-a4d0-4eab-aac6-a8b83471cf64” }

Consent to Application.ReadWrite.All scope is required.

A successful request returns 201 Created with a display name of OwaDownloadAttachments. If the request reports that the service principal already exists, continue to Step 2.

Step 2: Exclude it from the policy

1. Click on View or Edit on the Conditional Access Policy you want to update.
2. Under Target resources, select the Exclude tab.
3. Choose Select resources, search for OwaDownloadAttachments, and select it.
4. Save the policy.

Repeat Step 2 for each policy you want attachment operations exempted from.

Source: Microsoft Message Center • Analysed by MWPro

<<< [MC1472591] Archive
Tooltip: View earlier revisions of this post