Investigate OWA PDF preview failures without removing the download block

Source facts

Some PDF preview or print operations initiate a file download, which can trigger Defender for Cloud Apps download blocking. For Outlook on the web, Microsoft’s documented adjustment disables direct file access on both private and public computers in the applicable OWA mailbox policy. Its expected test result removes the Download option while allowing preview. Custom or additional OWA policies may apply to particular users, so changing only the default policy may not cover them. Microsoft Learn.

Applicability

Use this branch for an OWA PDF-preview symptom under an identified download-blocking session policy. Determine the user’s effective mailbox policy and preserve the original settings. Do not generalize this Exchange-specific adjustment to every application that renders PDFs or every blocked-file event.

DSE recommendation

Check the user’s effective OWA mailbox policy before weakening the Cloud Apps download restriction. Have the Exchange and security owners agree which users need preview and which download restriction must remain. Review the documented direct-file-access parameters and their intended scope in a test policy. Prepare the prior configuration for recovery and communicate the expected user experience before applying any production change.

Verification

With a non-sensitive PDF and the download-blocking session policy still active, test preview for a representative affected user. Confirm both the preview result and the absence of the prohibited Download option. Repeat against any distinct OWA policy assignments in scope rather than assuming the default represents all users. Retain the effective policies and observed results, and investigate other failure causes if the documented combination does not produce the expected behavior.

Official references

Microsoft Learn: Troubleshooting access and session controls for end-users. Source reviewed September 9, 2026.