Limit SharePoint and OneDrive to web-only access from unmanaged devices

Description

Users on devices that are neither compliant in Intune nor hybrid joined get browser-only access to SharePoint and OneDrive: they can view (and, unless restricted, edit in the browser) but cannot download, print or sync, and cannot use desktop or mobile apps (ConditionalAccessPolicy = AllowLimitedAccess, or BlockAccess for a stricter setting).

The SharePoint admin center setting creates the Entra Conditional Access policies that enforce it (app-enforced restrictions for browser access and a block for client apps on unmanaged devices).

Rationale

Once a file is downloaded to an unmanaged device, the organization loses control over it: no encryption guarantee, no remote wipe, no endpoint DLP, and it may reach backups or other users of that device. Web-only access keeps people productive from personal devices while the data stays in the service.

Impact

On unmanaged devices users cannot open files in desktop apps, use the OneDrive sync client or the mobile apps, download or print. Images uploaded to classic pages may not render. Guests who authenticate with a verification code are also affected unless exempted with Set-SPOTenant -ApplyAppEnforcedRestrictionsToAdHocRecipients $false. Anyone links are not covered, so keep them off (CB-M365-COLLAB-003). The change can take up to 24 hours. A tenant-wide Conditional Access policy requiring a managed device for all resources (CB-M365-AUTH-020) gives broader coverage.

Applies when

Requires: Microsoft Entra ID P1

Setting

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Access control > Unmanaged devices and check that Allow limited, web-only access or Block access is selected.
3. In the Microsoft Entra admin center, browse to Entra ID > Conditional Access > Policies and check that the policies created by the SharePoint admin center (names starting with [SharePoint admin center]) are On and not edited to exclude broad groups.
4. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object ConditionalAccessPolicy must return AllowLimitedAccess or BlockAccess.
5. Fail if unmanaged devices have full access, or if the Conditional Access policies are off or in report-only mode.

Remediation

1. Make sure managed devices are compliant in Intune or hybrid joined, and that users on managed devices use a supported browser; otherwise they also get limited access.
2. Block legacy authentication first (CB-M365-COLLAB-001), since legacy clients bypass device restrictions.
3. In the SharePoint admin center, browse to Policies > Access control > Unmanaged devices, select Allow limited, web-only access and Save. Roles: SharePoint Administrator, plus Conditional Access Administrator for the policies the page creates.
4. PowerShell equivalent: Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess. Optional: -AllowEditing $false for read-only browser access.
5. To pilot, create the app-enforced restrictions policy in Entra for a test group first and set limited access on a few sites with Set-SPOSite -Identity <URL> -ConditionalAccessPolicy AllowLimitedAccess.

Rollback

Select Allow full access from desktop apps, mobile apps, and the web, or run Set-SPOTenant -ConditionalAccessPolicy AllowFullAccess. It can take up to 24 hours.

References

• Control access from unmanaged devices Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-COLLAB-001 Block legacy authentication protocols to SharePoint and OneDrive
• related CB-M365-COLLAB-003 Restrict SharePoint external sharing to authenticated guests
• related CB-M365-AUTH-020 Require a compliant or hybrid joined device to access resources

People and lifecycle