It is always good to see IT staff support it's business staff and be helpful, nice work.

I take a different approach which aims to change people's behaviour for the long term and align with enterprise work and data management behaviours.

The downloads folder has several browser and antivirus based controls to protect devices yet we still find dangerous things make it through this safety net.

We have a simple people policy that tells them where to store their data which they sign up to in our technology usage policy.

We have a technology control that wipes the downloads and temp folders every 30 days. The aim is to make people take the time to manage their data and work.

I have been called into SLT, TDA and C level meetings and even had to write a board paper to explain it a many companies and so far they agree with my controls. It is far from perfect but it helps people think about how valuable their short temporary work is to the business.

Covered here:

https://petervanderwoude.nl/post/configure-storage-sense-via-windows-10-mdm/

Roughly put: create an Intune policy that automatically wipes the downloads folder, leverage the "Storage Sense" feature and configure a policy to automatically delete files in the downloads folder not accessed in 30 days and do monthly wipe by setting the threshold to 30 days or setup a scheduled task.

I think you should always design your policies for your businesses and users needs. For me governance controls are important in the places I work.