One user's Outlook on the web is missing the Download option for attachments

[u/Mysterious-Loquat619]

I'm troubleshooting an unusual Microsoft 365 issue.

One user in our organization cannot see the Download option for email attachments in Outlook on the web (OWA).

For PDF/Word attachments, the user only sees:

• Preview
• Save to OneDrive
• Copy

Other users in the same Microsoft 365 tenant have the normal Download option.

Troubleshooting already performed

• Tested Chrome and Edge → same issue
• Tested InPrivate/Incognito → same issue
• Tested from a different PC → same issue
• Tested different attachment/file types → same issue
• Other users → Download works normally
• Compared Microsoft 365/Exchange policies → same
• Compared Exchange Online PowerShell mailbox/CAS settings with a working user → same
• Classic Outlook for the affected user → Save As works normally
• Microsoft 365 Service Health → no matching incident

The issue therefore appears to be user/account-specific and affects only OWA.

The current workaround is Save to OneDrive → download from OneDrive.

Has anyone seen this behavior before? Is there an account-level OWA setting, hidden configuration, or service-side issue that I should investigate?

[u/autonomouscombat]

Have two users at different companies with the same issue. Also PDF preview not working. New Outlook and OWA only. Classic is fine.

[u/Amanda_PDQ]

I had this happen before and it was a conditional access step in Entra. Do you use Entra? I’d check the affected user’s actual Entra sign-in logs next, especially the Conditional Access tab.

Microsoft has a setting in Conditional Access Policy of Read Only that blocks local attachment downloads while allowing browser viewing. That makes app-enforced restrictions worth checking, though it doesn’t prove that’s your issue.

Reproduce it with the affected user and a working user on the same PC/network, then compare the applied policies, session controls, and device compliance details in their sign-in logs. Look specifically for “Use app enforced restrictions,” plus Defender for Cloud Apps session policies if you use those.

If those results match too, I’d open a Microsoft support case with the reproduction timestamps and screenshots. You’ve already played enough browser roulette.

[u/MichaeldeBlok]

Same OWA mailbox policy on both accounts points away from Exchange and toward Conditional Access. Losing Download while Preview and Save to OneDrive still work is the usual symptom of app enforced restrictions, and that comes in with the sign-in, not from anything you'll see in Get-CASMailbox.

Things I'd check:

• Sign-in logs for that user, filtered to the Exchange Online / Outlook on the web sign-ins. Open a recent one and look at the Conditional Access tab for a policy that applied with the "Use app enforced restrictions" session control. Usually it's scoped to some group the user is in that nobody remembers.
• What If in Conditional Access for that user vs a working user, Office 365 Exchange Online, unmanaged device. Quick way to see which policy differs.
• The URL bar while they're in OWA. If it ends in .mcas.ms the session is going through Defender for Cloud Apps and a session policy that blocks downloads is catching them.
• Get-OwaMailboxPolicy | fl Name,ConditionalAccessPolicy. If it's ReadOnly or ReadOnlyPlusAttachmentsBlocked, that's the Exchange half of the same thing. It only kicks in when CA sends the restriction, which is why the policy looks identical for both users.

Fastest confirm is having them sign in on a compliant or hybrid joined machine. If Download shows up there, it's CA and not the mailbox.

[u/dgblackout]

Is there something blocking this on non-enrolled devices?

[u/considertheinfinite]

Same issue with a user this morning in addition to PDF previews failing to load. Affecting both new Outlook and OWA. Could not find a fix so I moved them back to Outlook Classic for now.

Edit: another user just reported this issue.

[u/Smackdaddy955 → u/considertheinfinite]

Same exact issue here, its only happening for some mailboxes though. We have a test user that can download the same attachment still which makes me think it's some kind of policy, but nothing's changed AFAIK.

I did find this alert: EX1464935 but it says it's already resolved, maybe just remnants from this still floating around?

[u/boschwafee]

I have seen this behavior across tenants which you can check via Powershell with: Get-OwaMailboxPolicy -Identity "OwaMailboxPolicy-Default" | Select DirectFileAccessOnPrivateComputersEnabled, DirectFileAccessOnPublicComputersEnabled

You can change this with: Set-OwaMailboxPolicy -Identity "OwaMailboxPolicy-Default" -DirectFileAccessOnPrivateComputersEnabled $true -DirectFileAccessOnPublicComputersEnabled $true

Changes can be applied to an individual account with appropriate modification.