O365 sharepoint-online-downloading not matching while downloading excel files

Showing results for 
Show  only  | Search instead for 
Did you mean: 

O365 sharepoint-online-downloading not matching while downloading excel files

L4 Transporter

The application sharepoint-online-downloading will catch word docs.   However it does not catch excel file downloads. If we block sharepoint-online-downloading - it will bock everything but excel file and powerpoint downloads.    I'm not sure why, but excel files and powerpoint come through as the app sharepoint-online ....Why?



Cyber Elite
Cyber Elite

Just to verify, you are decrypting all of this traffic correct? 

Yes.   Decryption is working normally.   I should specify, that this is when you click on  File/save as/ "download a copy", and try to download it.   Correction - only Word docs get blocked, and marked as sharepoint-online-downloading.  Both powerpoint and  Excel documents come through, and marked as the application sharepoint-online, not sharepoint-online-downloading.  Workaround/solution is to block these files in the app sharepoint-online?


I was able to reproduce this easily enough, so you probably want to open a ticket with TAC so they can get the application team to take a look at things. As a work around, you could assign a file-blocking profile to the rule allowing this traffic and simply deny users from downloading powerpoint or excel files if the application is identified as sharepoint-online.

How many people know about this?  - if this is true - O365 environments are not as secure as once thought right now.

  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!