Block Downloads In MS TEAMS Thick Client For Non Managed Computers

How to remove the download, save as or print option from the MS Teams thick client application on unmanaged device, logged into your corporate tenancy via a conditional access policy.

  1. Create a group : Block_Teams_Thick_Client_Downloads
  2. Add users to the group you want to block access to download, save as or print.
  3. Create a new conditional access policy – Example : Block Teams Thick Client Downloads
    1. Users and Groups add “Block_Teams_Thick_Client_Downloads”
    2. Cloud Apps or Actions – Select Apps – MS Teams
    3. Conditions – Select Client Apps> Configure >Yes> Tick : Mobile Apps, Exchange and Other Clients. Untick Browser.
    4. Device state (Currently in preview) > Set exclude > Tick : Hybrid Azure AD joined and Device marked as compliant
    5. Grant – Select > Block Access and For Multiple controls > “Require one of the selected controls”

Useful links:

Block Access From Unmanaged Devices To SharePoint or Specific Sites

Block Access From Unmanaged Devices To SharePoint

From SharePoint Admin Center > Polices > Access Control

Click Unmanaged Devices

Note “To use this setting, get a subscription to Enterprise Mobility + Security and assign a license to yourself. ” See Microsoft Endpoint Manager | Microsoft 365 for more information

Select Block Access > Save

Block Access From Unmanaged Devices To SharePoint Specific Sites and Limit access using PowerShell.

Examples block download, save and print on unmanaged devices for a specific SharePoint site (SharePoint, OneDrive)

  • Limit access to a single site: Set-SPOSite -Identity https://<SharePoint online URL>/sites/<name of site or OneDrive account> -ConditionalAccessPolicy AllowLimitedAccess

     

  • Block access to a single site: Set-SPOSite -Identity https://<SharePoint online URL>/sites/<name of site or OneDrive account> -ConditionalAccessPolicy BlockAccess

     

  • Update multiple sites at once: (Get-SPOSite -IncludePersonalSite
    $true -Limit all -Filter
    “Url -like ‘-my.sharepoint.com/personal/'”) | Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess

Intune Company Portal Install On An iPhone Device – MDM

Intune – Mobile Device Management – Intune Company Portal Install On An iPhone Device

Lets focus on BYOD (Bring Your Own Device)

Example Apple – iOS enrolment

BYOD

  • Devices are not wiped during enrolment
  • Device is associated with a user
  • Users can unenroll the device

At this point we should have completed the basics in the Intune configuration portal

  1. Install the “Intune Company Portal” application in the App Store


  1. Open the Intune Company Portal App


2. Sign in or Just select your Office365 account > Continue


3. Begin


4. Continue or Select Can


5. Continue


6. Continue


7. Allow


8. Close


9. Settings > Profile Downloaded


10. Install


11. Enter Passcode


12. Install
 

13. Install

15. Trust

16. Done

 

17. Close settings – Note “Mobile Profile”
18. Back to app and click “Continue Now”

19. Done
—-

Success !!! Device is now enrolled and awaiting apps and policies


Intune – MDM – Device Enrolment – Add an iPhone Device

Intune – Mobile Device Management – Device Enrolment – Add a Device

Lets focus on BYOD (Bring Your Own Device)

Example Apple – iOS enrolment

BYOD

  • Devices are not wiped during enrolment
  • Device is associated with a user
  • Users can unenroll the device

At this point we have already completed the Pre Req’s (See Apple MDM Push Certificate if you haven’t done this already)

Apple Configurator / Devices

https://devicemanagement.microsoft.com

We need to add an iOS device you will need the serial number and device detail in a CSV file to import

CSV format <device serial>,<Detail Owner? Device type)

Add a device

Devices> iOS > Apple Configurator

Have you created a Profile? Create a Profile before adding a device, see this guide

Select a profile and import your CSV file contain all your devices. Then click add.

Success !! Devices Added

Additional info from Microsoft Docs available here

Intune – MDM – Device Enrolment – Create a Profile

Intune – Mobile Device Management – Device Enrolment – Create a Profile

Lets focus on BYOD (Bring Your Own Device)

Example Apple – iOS enrolment

BYOD

  • Devices are not wiped during enrolment
  • Device is associated with a user
  • Users can unenroll the device

At this point we have already completed the Pre Req’s (See Apple MDM Push Certificate if you haven’t done this already)

Now : Create a Profile

You need to create a profile before enrolling a device.

Apple Configurator / Devices

https://devicemanagement.microsoft.com

We need to add a Profile

Profiles > Create


Enrol with User Affinity ( i.e Map the Device to a User) + Auth via company Portal (Example options selected)


Then click “Create”

Success a profile is created


Intune – Apple MDM Push Certificate

Intune – Mobile Device Management – Device Enrolment – Apple MDM Push Certificate

Lets focus on BYOD (Bring Your Own Device)

Example Apple – iOS enrolment

BYOD

  • Devices are not wiped during enrolment
  • Device is associated with a user
  • Users can unenroll the device

MDM push Certificate required

Go to device management https://devicemanagement.microsoft.com

Enrol iOS devices in Intune


Devices > Apple Enrollment > Apple MDM Push Certificate

You will need an Apple ID used on your Device

Step 3 expanded….

Create your MDM push certificate redirects you to login to the Apple portal with your Apple ID

https://identity.apple.com/pushcert/

Click “Create a Certificate

Read, Tick and Accept the terms

Upload your CSR

Download Certificate

Then View Manage Certificates. Note Expiry date!


Now back to step 4.


Enter Apple ID

Step 5


Add your MDM push certificate


Click upload

Success….