# Investigate OWA PDF preview failures without removing the download block

> Why can a Cloud Apps download-blocking policy also prevent an Outlook on the web PDF preview?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-586-investigate-owa-pdf-preview-failures-without-removing-the-download-block/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:22:10+00:00
- Modified: 2026-09-10T02:14:31+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Why can a Cloud Apps download-blocking policy also prevent an Outlook on the web PDF preview?

## Potentially affected

Outlook on the web sessions where Defender for Cloud Apps session policy blocks downloads.

## DSE recommendation

Check the user's effective OWA mailbox policy before weakening the Cloud Apps download restriction.

## Article

## Source facts

Some PDF preview or print operations initiate a file download, which can trigger Defender for Cloud Apps download blocking. For Outlook on the web, Microsoft’s documented adjustment disables direct file access on both private and public computers in the applicable OWA mailbox policy. Its expected test result removes the Download option while allowing preview. Custom or additional OWA policies may apply to particular users, so changing only the default policy may not cover them. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-end-users).

## Applicability

Use this branch for an OWA PDF-preview symptom under an identified download-blocking session policy. Determine the user’s effective mailbox policy and preserve the original settings. Do not generalize this Exchange-specific adjustment to every application that renders PDFs or every blocked-file event.

## DSE recommendation

Check the user’s effective OWA mailbox policy before weakening the Cloud Apps download restriction. Have the Exchange and security owners agree which users need preview and which download restriction must remain. Review the documented direct-file-access parameters and their intended scope in a test policy. Prepare the prior configuration for recovery and communicate the expected user experience before applying any production change.

## Verification

With a non-sensitive PDF and the download-blocking session policy still active, test preview for a representative affected user. Confirm both the preview result and the absence of the prohibited Download option. Repeat against any distinct OWA policy assignments in scope rather than assuming the default represents all users. Retain the effective policies and observed results, and investigate other failure causes if the documented combination does not produce the expected behavior.

## Official references

[Microsoft Learn: Troubleshooting access and session controls for end-users](https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-end-users). Source reviewed September 9, 2026.

## Primary reference

- Name: Troubleshooting access and session controls for end-users - Microsoft Defender for Cloud Apps | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-end-users
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Investigate OWA PDF preview failures without removing the download block,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-586-investigate-owa-pdf-preview-failures-without-removing-the-download-block/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.