Is there any way to prevent users on unmanaged/personal devices from downloading inline images in Microsoft Teams chats/channels?

Question

Is there any way to prevent users on unmanaged/personal devices from downloading inline images in Microsoft Teams chats/channels?

Hoan 0

Currently, file downloads are already blocked through existing web-only access policies. Previously, pasted images were stored in OneDrive/SharePoint, so the restriction worked correctly. However, inline images are now handled through Azure Media Services, which still allows users to download them locally on unmanaged devices.

0 comments

2 answers

Your answer

Answer 1

Hi @Hoan,

At the moment, there is no direct way to prevent users on unmanaged or personal devices from downloading inline images in Microsoft Teams chats or channels. This is because inline images are now served through Azure Media Services, which are not governed by the same controls as files stored in SharePoint or OneDrive.

Reference: Enable inline image support in your Chat app - An Azure Communication Services quickstart | Microso…

As of now, the available options are only partial mitigations. You can continue using Defender for Cloud Apps session controls to restrict download, copy, and print actions, but this does not fully block inline image saving. You may also apply DLP or sensitivity labels to reduce the likelihood of sensitive images being shared, though this will not stop downloads once the images are visible.

Reference: Block download policy for SharePoint sites and OneDrive - SharePoint in Microsoft 365 | Microsoft L…

If your requirement is strict data protection, the only fully effective approach is to block Teams access from unmanaged devices altogether, as there is currently no granular control specifically for inline media. For further information regarding to this topic, kindly visit: Control access from unmanaged devices - SharePoint in Microsoft 365 | Microsoft Learn

I hope you find this information helpful. If anything is unclear, please don’t hesitate to reach out to me.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have any extra questions about this answer, please click "Comment."

If you want to receive the related email notification for this thread, please follow the steps in our documentation to enable e-mail notifications.

Answer 2

The provided information only covers blocking or limiting access to SharePoint/OneDrive content (including Teams files) from unmanaged devices, and blocking downloads of files that are identified as malicious by Safe Attachments. It does not describe any control that specifically prevents downloading inline images delivered via Azure Media Services in Microsoft Teams chats/channels.

From the available details, the following controls exist:

Block or limit SharePoint/OneDrive access from unmanaged devices
- Organization-wide or per-site/OneDrive policies can be configured so that users on unmanaged devices have web-only access and cannot download, print, or sync files.
- This is done via:
  - SharePoint admin center → Access control → Unmanaged devices → Allow limited, web-only access, or
  - PowerShell: Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess.
- Site-level overrides can be set with Set-SPOSite -ConditionalAccessPolicy AllowLimitedAccess or BlockAccess.
Block downloading of files detected as malicious
- For files flagged by Safe Attachments in SharePoint, OneDrive, and Teams, users can be prevented from downloading them by running:
```
     Set-SPOTenant -DisallowInfectedFileDownload $true
```

These controls apply to SharePoint/OneDrive-backed content and to malicious files, but there is no documented setting in the provided material that targets inline images handled via Azure Media Services in Teams chats/channels or blocks their download specifically on unmanaged devices.

References: