{
  "id": "CB-M365-COLLAB-015",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-015",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-015.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-015.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-015",
    "title": "Limit SharePoint and OneDrive to web-only access from unmanaged devices",
    "finding": {
      "title": "Unmanaged devices can download and sync SharePoint and OneDrive content",
      "description": "Files end up on personal or unknown devices that the organization cannot wipe, encrypt or monitor."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "unmanaged-devices",
      "conditional-access",
      "sharepoint",
      "onedrive",
      "data-loss-prevention"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "Users on devices that are neither compliant in Intune nor hybrid joined get browser-only access to\nSharePoint and OneDrive: they can view (and, unless restricted, edit in the browser) but cannot\ndownload, print or sync, and cannot use desktop or mobile apps (`ConditionalAccessPolicy` =\n`AllowLimitedAccess`, or `BlockAccess` for a stricter setting).\n\nThe SharePoint admin center setting creates the Entra Conditional Access policies that enforce it\n(app-enforced restrictions for browser access and a block for client apps on unmanaged devices).\n",
    "rationale": "Once a file is downloaded to an unmanaged device, the organization loses control over it: no\nencryption guarantee, no remote wipe, no endpoint DLP, and it may reach backups or other users of\nthat device. Web-only access keeps people productive from personal devices while the data stays in\nthe service.\n",
    "impact": "On unmanaged devices users cannot open files in desktop apps, use the OneDrive sync client or the\nmobile apps, download or print. Images uploaded to classic pages may not render. Guests who\nauthenticate with a verification code are also affected unless exempted with\n`Set-SPOTenant -ApplyAppEnforcedRestrictionsToAdHocRecipients $false`. **Anyone** links are not\ncovered, so keep them off (CB-M365-COLLAB-003). The change can take up to 24 hours. A tenant-wide\nConditional Access policy requiring a managed device for all resources (CB-M365-AUTH-020) gives\nbroader coverage.\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Access control > Unmanaged devices",
      "default_value": "Allow full access from desktop apps, mobile apps, and the web",
      "recommended_value": "Allow limited, web-only access (ConditionalAccessPolicy = AllowLimitedAccess) or Block access"
    },
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Access control** > **Unmanaged devices** and check that **Allow\n   limited, web-only access** or **Block access** is selected.\n3. In the Microsoft Entra admin center, browse to **Entra ID** > **Conditional Access** >\n   **Policies** and check that the policies created by the SharePoint admin center (names starting\n   with `[SharePoint admin center]`) are **On** and not edited to exclude broad groups.\n4. With the SharePoint Online Management Shell (SharePoint Administrator):\n   `Get-SPOTenant | Select-Object ConditionalAccessPolicy` must return `AllowLimitedAccess` or\n   `BlockAccess`.\n5. Fail if unmanaged devices have full access, or if the Conditional Access policies are off or in\n   report-only mode.\n"
    },
    "remediation": {
      "manual": "1. Make sure managed devices are compliant in Intune or hybrid joined, and that users on managed\n   devices use a supported browser; otherwise they also get limited access.\n2. Block legacy authentication first (CB-M365-COLLAB-001), since legacy clients bypass device\n   restrictions.\n3. In the SharePoint admin center, browse to **Policies** > **Access control** > **Unmanaged\n   devices**, select **Allow limited, web-only access** and **Save**. Roles: SharePoint\n   Administrator, plus Conditional Access Administrator for the policies the page creates.\n4. PowerShell equivalent: `Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess`. Optional:\n   `-AllowEditing $false` for read-only browser access.\n5. To pilot, create the app-enforced restrictions policy in Entra for a test group first and set\n   limited access on a few sites with\n   `Set-SPOSite -Identity <URL> -ConditionalAccessPolicy AllowLimitedAccess`.\n",
      "rollback": "Select **Allow full access from desktop apps, mobile apps, and the web**, or run\n`Set-SPOTenant -ConditionalAccessPolicy AllowFullAccess`. It can take up to 24 hours.\n"
    },
    "references": [
      {
        "title": "Control access from unmanaged devices",
        "url": "https://learn.microsoft.com/sharepoint/control-access-from-unmanaged-devices",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-19",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-20(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1530"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-001",
        "type": "requires"
      },
      {
        "id": "CB-M365-COLLAB-003",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-020",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}