What the blob governs
Get-OwaMailboxPolicy | fl runs long: feature toggles (calendar, contacts, ActiveSync device management from OWA), attachment policy (direct download vs web-view-only vs blocked — the unmanaged-device lever), third-party file providers, offline mode, signatures, weather and other delights. Assignment is per-mailbox (CASMailbox.OwaMailboxPolicy), default policy for the unassigned — the plan/override layering from the limits concept, applied to the browser.
Two modern reasons this sleepy blob got interesting:
- Unmanaged-access designs: paired with Conditional Access app-enforced restrictions, OWA policies deliver the 'browser-only, no downloads' posture for BYOD — the attachment settings are the working half of that promise.
- The new-Outlook switches: OneWinNativeOutlookEnabled (the toggle governing new Outlook for Windows availability) and its companions live here — the property our verdict engine flagged under MC949965, null-means-default and all. The Windows client's migration is administered through the OWA policy, of all places — a naming fossil worth knowing.
Failure/behaviour notes
Policy changes propagate on the usual cache timers (hours at the long tail); per-feature 'missing button' tickets resolve to the assigned policy's toggles far more often than to licensing; and multiple policies only pay when populations genuinely differ (kiosk/frontline restricted vs knowledge-worker full) — the two-policy estate is healthy, the nine-policy estate is archaeology.
What to watch (proofs)
- The blob, versioned: our nightly scan holds OwaMailboxPolicy — the MC949965 verdict literally reads it; drift on attachment or new-Outlook switches is a dated diff.
- Assignment census: CASMailbox policy distribution — who's on non-default policies and why (the odd-rows cleanup queue).
- The BYOD posture, tested: an unmanaged-browser session against the attachment settings — download blocked/web-view working is a screenshot, not an assumption (CA + OWA policy proven together).
- New-Outlook rollout state: the toggle values against your migration wave plan — the verdicts page already tracks the gap.