# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-COLLAB-015
title: Limit SharePoint and OneDrive to web-only access from unmanaged devices
finding:
  title: Unmanaged devices can download and sync SharePoint and OneDrive content
  description: Files end up on personal or unknown devices that the organization cannot wipe, encrypt or monitor.
status: active
profiles: [hardened]
risk:
  severity: medium
assessment: manual
tags: [unmanaged-devices, conditional-access, sharepoint, onedrive, data-loss-prevention]

applicability:
  requires:
    - Microsoft Entra ID P1

description: |
  Users on devices that are neither compliant in Intune nor hybrid joined get browser-only access to
  SharePoint and OneDrive: they can view (and, unless restricted, edit in the browser) but cannot
  download, print or sync, and cannot use desktop or mobile apps (`ConditionalAccessPolicy` =
  `AllowLimitedAccess`, or `BlockAccess` for a stricter setting).

  The SharePoint admin center setting creates the Entra Conditional Access policies that enforce it
  (app-enforced restrictions for browser access and a block for client apps on unmanaged devices).
rationale: |
  Once a file is downloaded to an unmanaged device, the organization loses control over it: no
  encryption guarantee, no remote wipe, no endpoint DLP, and it may reach backups or other users of
  that device. Web-only access keeps people productive from personal devices while the data stays in
  the service.
impact: |
  On unmanaged devices users cannot open files in desktop apps, use the OneDrive sync client or the
  mobile apps, download or print. Images uploaded to classic pages may not render. Guests who
  authenticate with a verification code are also affected unless exempted with
  `Set-SPOTenant -ApplyAppEnforcedRestrictionsToAdHocRecipients $false`. **Anyone** links are not
  covered, so keep them off (CB-M365-COLLAB-003). The change can take up to 24 hours. A tenant-wide
  Conditional Access policy requiring a managed device for all resources (CB-M365-AUTH-020) gives
  broader coverage.

setting:
  location: SharePoint admin center > Policies > Access control > Unmanaged devices
  default_value: Allow full access from desktop apps, mobile apps, and the web
  recommended_value: Allow limited, web-only access (ConditionalAccessPolicy = AllowLimitedAccess) or Block access

audit:
  manual: |
    1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a
       Global Reader.
    2. Browse to **Policies** > **Access control** > **Unmanaged devices** and check that **Allow
       limited, web-only access** or **Block access** is selected.
    3. In the Microsoft Entra admin center, browse to **Entra ID** > **Conditional Access** >
       **Policies** and check that the policies created by the SharePoint admin center (names starting
       with `[SharePoint admin center]`) are **On** and not edited to exclude broad groups.
    4. With the SharePoint Online Management Shell (SharePoint Administrator):
       `Get-SPOTenant | Select-Object ConditionalAccessPolicy` must return `AllowLimitedAccess` or
       `BlockAccess`.
    5. Fail if unmanaged devices have full access, or if the Conditional Access policies are off or in
       report-only mode.

remediation:
  manual: |
    1. Make sure managed devices are compliant in Intune or hybrid joined, and that users on managed
       devices use a supported browser; otherwise they also get limited access.
    2. Block legacy authentication first (CB-M365-COLLAB-001), since legacy clients bypass device
       restrictions.
    3. In the SharePoint admin center, browse to **Policies** > **Access control** > **Unmanaged
       devices**, select **Allow limited, web-only access** and **Save**. Roles: SharePoint
       Administrator, plus Conditional Access Administrator for the policies the page creates.
    4. PowerShell equivalent: `Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess`. Optional:
       `-AllowEditing $false` for read-only browser access.
    5. To pilot, create the app-enforced restrictions policy in Entra for a test group first and set
       limited access on a few sites with
       `Set-SPOSite -Identity <URL> -ConditionalAccessPolicy AllowLimitedAccess`.
  rollback: |
    Select **Allow full access from desktop apps, mobile apps, and the web**, or run
    `Set-SPOTenant -ConditionalAccessPolicy AllowFullAccess`. It can take up to 24 hours.

references:
  - title: Control access from unmanaged devices
    url: https://learn.microsoft.com/sharepoint/control-access-from-unmanaged-devices
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Set-SPOTenant (SharePoint Online Management Shell)
    url: https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-19
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-20(1)
    relation: related
threats:
  - framework: mitre-attack
    id: T1530
related_controls:
  - id: CB-M365-COLLAB-001
    type: requires
  - id: CB-M365-COLLAB-003
    type: related
  - id: CB-M365-AUTH-020
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24