Office 365 Apps (Word) issues saving since 2.20.4.1 update

To narrow down the issue a bit further, I'd recommend trying to turn off the following 2 features in the Threat Protection Policy to see if they’re also playing a part in things. 

- Real-time Scanning - Local Files and Network Shares  > Remote files
- Runtime Protection > Protect from remotely run ransomware

If disabling either of these options allows the saving of files to work normally, I'd recommend inquiring with support to see if further investigation can be done to resolve the issue. 

An additional step you can try (if the remotely run ransomware option turned off returns good results) is deploying the Hotfix for Intercept X when re-enabling the feature. 

Thanks, I’ll give that a try. In the event Ransomware protection or Remote file scanning is causing issues, would that reveal itself in the SEP logs?

We have a custom threat protection policy for this user with AMSI off. Depending on results, we can further disable the options you suggest. Alternatively, we can do a complete reinstall. 

The AMSI logs certainly suggest something is wrong, it’s unclear whether this is the cause or a symptom!

I also had this issue previously, but now it fixed..., Thanks

What fixed it? Latest version?

You may be able to get additional information returned by enabling verbose logging for the SAVService.

For Intercept X, the logging information may be a bit more limited, the most information can be found when a detection is raised. The process trace will be defined in the Event Viewer logs (Event ID 911). 

Were you able to test either of the component isolations mentioned? 

I suspect what you're seeing in the AMSI log is a symptom, but is also likely the reason you’re running into this problem. It looks like the actual location of the saved file can not be determined.