Secure SharePoint from Unmanaged Devices

Users frequently access Microsoft 365 from personal computers, home devices, and other endpoints that aren’t managed by the organization.

While this provides flexibility, it can also introduce a data security risk. A user accessing SharePoint or OneDrive from an unmanaged device could potentially download, synchronize, or store corporate files on a device that isn’t protected by your organization’s security controls.

SharePoint Online provides built-in access controls that allow administrators to restrict what users can do when accessing SharePoint and OneDrive from unmanaged devices.

Depending on your security requirements, you can:

• Allow full access
• Allow limited, web-only access
• Completely block access

Microsoft considers devices unmanaged for this feature when they aren’t Microsoft Entra hybrid joined or compliant in Microsoft Intune.

Requirements

Before configuring unmanaged device access, make sure you have the appropriate administrative permissions and licensing.

You will need:

• SharePoint Administrator or higher permissions
• Microsoft Entra Conditional Access licensing
• Microsoft Entra ID P1 or P2 for users affected by the Conditional Access policy

The SharePoint unmanaged device access control uses Microsoft Entra Conditional Access behind the scenes to enforce the configured restrictions.

Understanding the Available Access Options

SharePoint Online provides three primary options for unmanaged devices.

Allow Full Access

Users accessing SharePoint or OneDrive from an unmanaged device receive normal access based on their existing SharePoint permissions.

They can potentially:

• View files
• Edit files
• Download files
• Print files
• Synchronize files using OneDrive
• Open files using Microsoft 365 desktop applications

This provides the best user experience but offers the least protection against corporate data being stored on unmanaged devices.

Allow Limited, Web-Only Access

This is often the most practical option for organizations that allow BYOD or occasional access from personal devices.

Users can access SharePoint and OneDrive through a supported web browser, but Microsoft restricts the ability to move corporate data onto the device.

By default, users on unmanaged devices cannot:

• Download files
• Print files
• Synchronize files using the OneDrive client
• Access the content through Microsoft Office desktop applications

Users can continue viewing and, by default, editing supported files directly in the browser.

This provides a balance between security and productivity.

Block Access

The most restrictive option completely prevents users from accessing SharePoint and OneDrive content from unmanaged devices.

Users attempting to access the content receive an access denied message indicating that organizational policy prevents access from the untrusted device.

This option may be appropriate for highly sensitive environments where corporate data should only be accessible from managed devices.

Configure Unmanaged Device Access

To configure the policy:

1. Sign in to the SharePoint Admin Center.
2. Navigate to: Policies → Access control
3. Select: Unmanaged devices
4. Choose the appropriate access level:
   • Allow full access
   • Allow limited, web-only access
   • Block access

For this example, select: Allow limited, web-only access

5. Select Save.

Microsoft creates or updates the corresponding Conditional Access policy used to enforce the SharePoint access restriction.

Important: Changing this setting from the SharePoint Admin Center can replace the Conditional Access policy previously generated by this configuration. Customizations made directly to a previous policy may not be retained.

What Happens to the User?

Users accessing SharePoint or OneDrive from a managed device continue to receive normal access.

Users accessing the same content from an unmanaged device receive a restricted browser experience.

For example, a user may still be able to open a Word document using Word for the web but will not be able to download the file to their computer.

The OneDrive synchronization client is also prevented from synchronizing protected SharePoint and OneDrive content to the unmanaged endpoint. Microsoft documents OneDrive sync support for device-based Conditional Access policies specifically to ensure synchronization occurs only on permitted devices.

Prevent Editing from Unmanaged Devices

Limited web-only access allows users to edit supported documents in their browser by default.

Organizations that want a more restrictive configuration can prevent browser-based editing as well.

Connect to the SharePoint Online Management Shell and configure:

Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess -AllowEditing $false

This prevents users affected by the unmanaged device policy from editing Office documents in the browser.

Make SharePoint Read-Only on Unmanaged Devices

Another option is to make the SharePoint environment read-only for users connecting from unmanaged devices.

Use:

Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess -ReadOnlyForUnmanagedDevices $true

This allows users to access content while preventing changes from unmanaged devices.

Configure the Policy Using PowerShell

The organization-wide setting can also be configured using the SharePoint Online Management Shell.

Connect to SharePoint Online using an account with at least SharePoint Administrator permissions.

To configure limited web-only access:

Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess

To completely block access from unmanaged devices:

Set-SPOTenant -ConditionalAccessPolicy BlockAccess

To return to unrestricted access:

Set-SPOTenant -ConditionalAccessPolicy AllowFullAccess

Microsoft notes that policy changes can take time to propagate, and some unmanaged devices with existing authenticated sessions may not immediately receive the updated restriction.

Restrict a Specific SharePoint Site

The policy does not necessarily need to be applied uniformly across every SharePoint site.

Organizations can apply different controls to specific sites based on the sensitivity of the information they contain.

For example, you may want:

• General collaboration sites to allow limited browser access
• HR sites to block unmanaged devices
• Finance sites to block unmanaged devices
• Public internal communication sites to remain less restrictive

To limit access to a specific site:

Set-SPOSite `
 -Identity https://YourTenantName.sharepoint.com/sites/SiteName `
 -ConditionalAccessPolicy AllowLimitedAccess

To completely block unmanaged device access to the site:

Set-SPOSite `
 -Identity https://YourTenantName.sharepoint.com/sites/SiteName `
 -ConditionalAccessPolicy BlockAccess

The organization-wide policy defines the maximum level of access that a site can allow.

A site-level policy can be more restrictive than the tenant setting, but it cannot be more permissive.

For example, if the tenant allows limited web access, an individual site can be configured to completely block unmanaged devices.

If the tenant is configured to block unmanaged devices entirely, an individual site cannot override that setting to allow limited access.

Restrict Access to a Specific OneDrive

OneDrive for Business uses SharePoint Online as its underlying storage platform, which means the same controls can also be applied to individual OneDrive sites.

For example:

Set-SPOSite `
 -Identity https://YourTenantName-my.sharepoint.com/personal/user_domain_com `
 -ConditionalAccessPolicy AllowLimitedAccess

This allows administrators to apply stricter controls to specific users’ OneDrive environments when necessary.

Apply Limited Access to All OneDrive Sites

Administrators can also enumerate all OneDrive sites and apply the policy using PowerShell.

For example:

Get-SPOSite -IncludePersonalSite $true -Limit All -Filter "Url -like '-my.sharepoint.com/personal/'" | Set-SPOSite -ConditionalAccessPolicy AllowLimitedAccess

This retrieves users’ OneDrive sites and applies limited access to each site.

Conditional Access Considerations

SharePoint unmanaged device restrictions depend on Microsoft Entra Conditional Access.

Microsoft also provides a Conditional Access session control called:

Use app enforced restrictions

This allows Microsoft 365 applications such as SharePoint to determine the appropriate level of access based on the Conditional Access result.

A Microsoft-recommended Conditional Access configuration includes:

1. Navigate to the Microsoft Entra Admin Center.
2. Go to: Entra ID → Conditional Access → Policies
3. Create a new Conditional Access policy.
4. Select the appropriate users or groups.
5. Exclude emergency access or break-glass accounts.
6. Under Target resources, select Office 365.
7. Under: Access controls → Sessionselect:Use app enforced restrictions
8. Initially configure the policy as:Report-only
9. Review the results before changing the policy to On.

Microsoft recommends excluding emergency access accounts from Conditional Access policies to reduce the risk of an administrative lockout.

Why Target Office 365 Instead of Only SharePoint?

SharePoint is tightly integrated with other Microsoft 365 services.

For example, Microsoft Teams stores channel files in SharePoint and chat files in OneDrive.

Microsoft recommends considering the broader Office 365 resource in Conditional Access policies because targeting SharePoint alone can result in inconsistent experiences across dependent Microsoft 365 services.

For example, a user might still be able to access a Teams conversation from an unmanaged device but receive an error when opening the Files tab because the underlying files are stored in SharePoint.

This dependency should be tested carefully before deploying the policy broadly.

Consider Blocking Legacy Authentication

Microsoft also recommends blocking applications that don’t use modern authentication when restricting unmanaged device access.

Older authentication protocols may not be capable of enforcing modern device-based Conditional Access controls.

This can be configured from:

SharePoint Admin Center → Policies → Access control → Apps that don’t use modern authentication

Select: Block access and save the configuration.

Be Careful with Anyone Links

An important consideration involves anonymous Anyone sharing links.

Microsoft notes that Anyone links don’t require authentication and therefore aren’t affected by these Conditional Access policies.

A user who possesses an Anyone link may still be able to download the shared file.

For sites protected by unmanaged device access restrictions, consider disabling Anyone links and requiring authenticated sharing instead.

Test Before Broad Deployment

Access restrictions can affect more than the SharePoint web interface.

Before deploying the policy organization-wide, test with a small group of users and validate common workflows such as:

• SharePoint web access
• OneDrive web access
• OneDrive synchronization
• Microsoft Teams Files tabs
• Word, Excel, and PowerPoint desktop applications
• Office for the web
• Power Apps
• Power Automate
• External sharing

Microsoft specifically recommends testing application behavior because blocking access or downloads can affect several Microsoft 365 applications and integrations.

A pilot group allows administrators to identify workflow issues before the restriction affects the entire organization.

Recommended Configuration

For many organizations, a practical baseline is:

Managed devices: Allow normal SharePoint and OneDrive access.

Unmanaged devices: Allow limited, web-only access.

This allows employees to access information when necessary without allowing corporate files to be downloaded or synchronized to an unmanaged endpoint.

For sites containing highly sensitive information, consider configuring:

-ConditionalAccessPolicy BlockAccess

Microsoft’s Zero Trust guidance follows a similar model, recommending limited browser access for enterprise-protected SharePoint sites and completely blocking unmanaged devices from sites requiring specialized security.

Summary

SharePoint and OneDrive unmanaged device access controls provide an additional layer of protection when users access corporate data from personal or otherwise unmanaged endpoints.

Using Allow limited, web-only access allows users to remain productive while preventing common data exfiltration paths such as:

• Downloading
• Printing
• OneDrive synchronization
• Opening files through desktop applications

More sensitive SharePoint sites can be configured to completely block unmanaged devices.

When combined with Microsoft Entra Conditional Access, device compliance, and appropriate external sharing controls, these settings provide an effective way to reduce the risk of corporate information being stored on devices outside of organizational control.

References

• Control access from unmanaged devices – Microsoft Learn
• Use application enforced restrictions for unmanaged devices – Microsoft Learn
• Enable Conditional Access support in the OneDrive sync app – Microsoft Learn
• Recommended policies for specific Microsoft 365 workloads – Microsoft Learn