So let's say you've hired some external consultants to work on a project. But you do not want them to be able to download the project files to their computers. Well if that's the case you've come to the right place. I'll be going over how to stop users from downloading files using Intune Conditional Access policies.
To start off open Intune and head over to the Conditional Access section. Create a new profile. Then add the users or groups you want this policy to apply to. For me I created a new group for the consultants so for me it looks like this
Then select the apps you want it to apply to. Since I only want them to use Office 365 I will be selecting just that, but you can make this apply to all cloud apps if that is what you want
Now move down to
Use Conditional Access App Control then select
Block downloads as such
After that is done Enable the policy and click create.
Now you can test this out by opening OneDrive and attempting to download something.
Here's what a user would see if they attempted to download a file