Microsoft 365 (O365)

In Microsoft 365 (O365), managing email attachment behavior for roaming users depends on policies set through Microsoft Purview, Intune, Group Policy, and Exchange Online settings. Here are the key aspects of managing roaming profile policies for email attachments:

1. OneDrive for Business as Default Save Location

• Microsoft encourages using OneDrive for Business for storing email attachments instead of local profiles.
• Policy Setting: Configure the Outlook policy to save attachments to OneDrive automatically.
• Implementation:
  • Via Intune: Administrative Templates → Microsoft Outlook → “Use OneDrive for Business for file attachments”
  • Via GPO: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\Preferences
    • OneDriveAttachmentsEnabled = 1 (Enable)

2. Outlook Cached Mode & Roaming Profile Handling

• Cached Exchange Mode can store OST files in a local or network path (but network storage is not recommended for OSTs).
• Policy Setting: If users roam across devices, enable “Outlook Cached Mode” with a reduced cache timeframe.
• Implementation:
  • Via Intune: Administrative Templates → Microsoft Outlook → “Cached Exchange Mode”
  • Via GPO: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\Cached Mode
    • Enable = 1
    • SyncWindowSetting = 1 (1 month)

3. Attachments Blocking & Security Policies

• Microsoft Defender for Office 365 can scan and block malicious attachments.
• Safe Attachments Policy:
  • Microsoft 365 Defender → Threat Policies → Safe Attachments
  • Enable “Dynamic Delivery” to allow email previews while scanning.

4. Conditional Access & DLP for Attachments

• Prevent attachments from being downloaded to unmanaged devices using Microsoft Endpoint Manager & Conditional Access.
• DLP Policy: Prevent data leakage by controlling who can download, print, or copy email attachments.
  • Compliance Center → Data Loss Prevention → Policies
  • Configure rules to restrict sharing outside the organization.

5. OWA (Outlook Web Access) Attachment Policies

• Configure attachment download restrictions for roaming users.
• Policy Setting: Block download of attachments in unmanaged devices.
  • Microsoft 365 Admin → Exchange Admin Center → Outlook Web App Policies
  • Modify OWA Mailbox Policy:
    • DirectFileAccessOnPublicComputersEnabled = False
    • DirectFileAccessOnPrivateComputersEnabled = False