I have a feature service (back end referenced SDE Postgres database) that is published to an internal portal. The feature service is password protected, ie not shared with everyone. I have added the link to the feature service to my organization's ArcGIS online content with the password embedded. I am able to edit features in ArcGIS online, view any feature attachments, and delete feature attachments. However I am unable to add attachments in ArcGIS online - there is a message of "file type unsupported" or no message at all and the attachment is never added. I can add the same attachment if I go to my portal's arcgis interface.
ArcGIS Online - two existing attachments that I can view or delete but unable to add any attachments through ArcGIS Online. Able to add and edit the features otherwise.
Portal - able to add the file
This seems like a bug...
Investigating further - if I access the the arcgis online web map through the Collector App I am able to add a photo.