How to stop/prevent users to upload and download from Teams, OneDrive for business and SharePoint Online for users which includes .EXE, .MSI and any other executable files?

Question

How to stop/prevent users to upload and download from Teams, OneDrive for business and SharePoint Online for users which includes .EXE, .MSI and any other executable files?

Vinod Survase 4,776

Is there any policy via Intune or Azure AD side that we should create and apply across org or group of users?

Accepted answer

2 additional answers

Your answer

Answer 1

Andy David - MVP 157.4K MVP Volunteer Moderator

My first recommendation would be Defender for Cloud apps and a CA Policy if you are licensed:

https://learn.microsoft.com/en-us/defender-cloud-apps/use-case-proxy-block-session-aad

Vinod Survase 4,776 Reputation points

2023-06-22T14:40:23.7666667+00:00

Thanks @Andy David - MVP for reply on this.

I have another question on top of that I got to know we can prevent download but what about upload and how we can prevent that will it be covered via this CA policy or how it is?
Vinod Survase 4,776 Reputation points

2023-06-22T14:43:42.6933333+00:00

Andy David - MVPI have another question on top that as per this docs we can prevent download on unmanaged devices but what about upload to those storage locations like SPO, Teams, ODB, will it prevent upload as well or how it is?

Andy David - MVPI have another question on top that as per this docs we can prevent download on unmanaged devices but what about upload to those storage locations like SPO, Teams, ODB, will it prevent upload as well or how it is?

Andy David - MVPI have another question on top that as per this docs we can prevent download on unmanaged devices but what about upload to those storage locations like SPO, Teams, ODB, will it prevent upload as well or how it is?

Answer 2

Maarten Leyman 1

As @Andy David - MVP suggested you can use Microsoft Defender for Cloud Apps (MDCA) to block uploads and downloads to Onedrive or Sharepoint Online in realtime only for browser sessions!

Uploading or downloading through for example Teams or copying One Drive synced files in file explorer are not covered by the conditional access proxy policies.

You can also create file policies to for example change permissions of files with a .exe extentions. https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies

Vinod Survase 4,776 Reputation points

2023-06-23T13:00:21.6866667+00:00

Thanks @Maarten Leyman

Will check this and make appropriate settings.

Answer 3

Emily Du-MSFT 51,836 Microsoft External Staff

Form SharePoint, there is no OOTB functionality to restrict specific file extensions when uploading files.

From OneDrive, go to SharePoint admin center -> Settings -> Sync -> Block uploads by file type.

https://learn.microsoft.com/en-US/sharepoint/block-file-types?WT.mc_id=365AdminCSH_spo

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Vinod Survase 4,776 Reputation points

2023-06-23T13:21:51.2266667+00:00

Thanks @Emily Du-MSFT

Its helpful.
Emily Du-MSFT 51,836 Reputation points Microsoft External Staff

2023-06-26T06:01:40.3+00:00

If you find any answers helpful to you, please remember to accept them.

It will help others who meet the similar question in this forum.

Thank you.
Prashant Gupta 0 Reputation points

2024-03-19T10:12:21.6866667+00:00

This is good but how to block upload of such files from Power Automate flows to OneDrive/SharePoint? Is there any possible solution for this?

Share via

How to stop/prevent users to upload and download from Teams, OneDrive for business and SharePoint Online for users which includes .EXE, .MSI and any other executable files?

2 additional answers

Your answer