{
"title": "Fire and Emergency NZ Blocks Downloads to Personal Devices (Browser-Only Access)",
"content": "Fire and Emergency New Zealand (FENZ) has announced it will prevent users from downloading documents to personal devices through Microsoft 365 services—including SharePoint Online, OneDrive, and Microsoft Teams—effective from 5pm on 8 June 2026. The move will retain browser-based access to files but strip away the ability to save, print, or sync data outside the organization’s managed environment.

The tightening of data access controls reflects a growing zero-trust posture among government agencies and critical infrastructure operators. As remote and hybrid work accelerates, the boundary between corporate and personal devices has blurred. FENZ’s policy aims to block the most common vector for accidental data leakage: the unmanaged smartphone, tablet, or home laptop.

Why Personal Devices Are the New Security Frontier

Over the past three years, organizations have rushed to enable bring-your-own-device (BYOD) programs, often with minimal safeguards. Microsoft’s own survey found that 67% of employees use personal devices for work, yet only half of those devices are properly protected. For an emergency services agency dealing with operational plans, incident reports, and possibly personal information, an unsecured download can have severe consequences.

The FENZ policy doesn’t forbid viewing documents—it only stops the local copy. That means a firefighter checking an incident report from home can still read it in a browser, but cannot download it onto their iPad. If the document is sensitive, that copy would exist in a less-guarded place, vulnerable to theft, malware, or accidental sharing.

How the Download Ban Works Technically

Microsoft 365 offers a suite of controls that can enforce this kind of policy without heavy endpoint management. The primary mechanism is Azure AD Conditional Access with session controls, layered through Microsoft Defender for Cloud Apps (formerly MCAS).

When a user attempts to access SharePoint Online, OneDrive, or Teams, Conditional Access evaluates the device’s compliance or management state. If the device is identified as unmanaged (not enrolled in Intune or hybrid-joined), the policy can route the session through a reverse proxy that limits actions. Specifically, the Block Downloads session control prevents the browser from downloading, printing, or syncing files. The user sees the content rendered in the browser (or an inline viewer) but all export options are greyed out.

In SharePoint Online, administrators have an additional, more native option: limited-access user permission lockdown mode and site-level unmanaged device policies. The latter—configured per site or across the tenant—can be set to “Allow