Outlook attachments now enforce Conditional Access: non-compliant users blocked from downloading, previewing and uploading (MC1472591)

Outlook attachments now enforce Conditional Access: non-compliant users blocked from downloading, previewing and uploading (MC1472591)

29 September 2026 — Microsoft has changed how Outlook on the web (OWA) and the new Outlook handle attachments, according to Message Center post MC1472591, published on 15 September and updated on 29 September 2026. Attachments now run under a separate application configuration, and Conditional Access policies are enforced for attachment operations. The change is available now.

Not yet independently verified. This rests on Microsoft's own Message Center post (published 15 September, updated 29 September), read through a public archive; no independent report was found. Your tenant's own Message Center is the authoritative copy. We will update this when it can be confirmed, and remove this note.

What changes

According to Microsoft:

• Conditional Access policies that you have already scoped to Exchange and Office cloud applications are now enforced for attachment download, preview and upload, including inline images.
• Users who do not meet your policies, for example on a non-compliant device or from a blocked location, can no longer download, preview or upload classic attachments.
• If a user's session stops satisfying a policy, attachment operations are blocked.
• An exclusion for Exchange Online in a policy does not automatically carry over to attachments. To exclude attachments, administrators must create a service principal for the application named OwaDownloadAttachments and exclude it from the policy.

The change applies only to Outlook on the web and the new Outlook.

Who is affected

Microsoft 365 tenants using Microsoft Entra Conditional Access with Exchange Online, particularly organisations with device-compliance, location or session controls, and those that rely on exclusions for particular groups or apps.

What to do

1. Review Conditional Access policies scoped to Exchange and Office 365, and check how they will now affect attachments for each user group.
2. If you rely on Exchange exclusions, decide whether attachments should also be excluded, and if so create the OwaDownloadAttachments service principal and add the exclusion.
3. Brief the help desk: users may see attachments blocked while mail itself still loads.
4. Tell users on unmanaged devices what to expect.
5. Watch the post for the follow-up changes Microsoft says are coming.

Why it matters for buyers

The change closes a gap where attachments could be retrieved under conditions that blocked other access, which security teams will welcome. But it changes behaviour without new configuration, so the first sign for many organisations will be help-desk tickets.

Sources

• Microsoft 365 Message Center MC1472591 (archive): Outlook attachments now enforce Conditional Access — 29 September 2026