Protecting data on BYOD devices

@Aran Billen Thanks for posting in our Q&A.

Based on my research, please refer to the following link to prevent users from saving data on local. However, it will block all data, not just protected data.

https://myitrambles.com/enhancing-data-security-preventing-users-from-saving-data-on-local-or-removable-drives-with-microsoft-intune/

Note: Non-Microsoft link, just for the reference.

Honestly, I didn't find that there is no method to fully realize this need. Let's wait someone else share more information.

Thanks for your understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hello @Aran Billen,

Thank you for posting your query on Microsoft Q&A.

From your description, I understand that your goal is to block downloads on BYOD devices while still allowing users to upload files to OneDrive. This can be achieved by creating a Conditional Access policy. In the CA policy session control, select Conditional Access App Control and choose either Use custom policy or Block downloads.

This setup will prevent users from downloading any files stored in Microsoft 365 resources, while still allowing them to upload files to OneDrive without issues.

Please refer to the following guides for step-by-step instructions on creating a Conditional Access policy:

Protect Office 365 data on unmanaged devices with Defender for Cloud Apps (Note: Non-Microsoft link, provided for reference only)

Use Conditional Access App Control in Defender for Cloud Apps

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.