O365 sharepoint-online-downloading not matching while downloading excel files

Reply
Highlighted
L4 Transporter

O365 sharepoint-online-downloading not matching while downloading excel files

The application sharepoint-online-downloading will catch word docs.   However it does not catch excel file downloads. If we block sharepoint-online-downloading - it will bock everything but excel file and powerpoint downloads.    I'm not sure why, but excel files and powerpoint come through as the app sharepoint-online ....Why?

 

Highlighted
L7 Applicator

Re: O365 sharepoint-online-downloading not matching while downloading excel files

Just to verify, you are decrypting all of this traffic correct? 

Highlighted
L4 Transporter

Re: O365 sharepoint-online-downloading not matching while downloading excel files

Yes.   Decryption is working normally.   I should specify, that this is when you click on  File/save as/ "download a copy", and try to download it.   Correction - only Word docs get blocked, and marked as sharepoint-online-downloading.  Both powerpoint and  Excel documents come through, and marked as the application sharepoint-online, not sharepoint-online-downloading.  Workaround/solution is to block these files in the app sharepoint-online?

Highlighted
L7 Applicator

Re: O365 sharepoint-online-downloading not matching while downloading excel files

@Sec101,

I was able to reproduce this easily enough, so you probably want to open a ticket with TAC so they can get the application team to take a look at things. As a work around, you could assign a file-blocking profile to the rule allowing this traffic and simply deny users from downloading powerpoint or excel files if the application is identified as sharepoint-online.

Highlighted
L4 Transporter

Re: O365 sharepoint-online-downloading not matching while downloading excel files

How many people know about this?  - if this is true - O365 environments are not as secure as once thought right now.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!