SharePoint and OneDrive on unmanaged devices: restrict without stopping work
A personal laptop, a hotel kiosk, a contractor's PC: all devices from which a user can open SharePoint or OneDrive and download sensitive documents. Microsoft 365 offers several levers to allow viewing while preventing data from leaving the managed environment.
The problem: data follows the download
Multifactor authentication protects the identity, not the device. Once signed in from an unmanaged machine, a user can download, sync or print files that then escape all control: no guaranteed disk encryption, no verified antivirus, no way to wipe them when the person leaves.
Three access levels for unmanaged devices
In the SharePoint admin center, the unmanaged devices access control offers three options:
- Allow full access: the default behaviour, no restriction.
- Allow limited, web-only access: viewing in the browser without download, print or sync.
- Block access: no access from a device that is not compliant or joined.
Limited access is often the best compromise: users can read and, depending on configuration, edit online, but files never leave the service. The setting can also be applied site by site, or through container sensitivity labels, to protect only sensitive spaces.
App-enforced restrictions and Conditional Access
Under the hood, limited access relies on Entra ID Conditional Access (which requires an Entra ID P1 licence) and the "Use app enforced restrictions" session control. Enabling the option in SharePoint creates Conditional Access policies; it is better to review them and integrate them into your own policy set rather than leave them as generated. Two points to watch:
- exclusions (service accounts, emergency access accounts) must be consistent with the rest of your policies;
- desktop and mobile apps must be covered too, otherwise users simply bypass the web restriction with a rich client.
Restricting sync to corporate PCs
The OneDrive sync client can be limited to computers joined to specific domains. This stops a personal PC from replicating entire libraries locally.
Set-SPOTenantSyncClientRestriction -Enable -DomainGuids "your-AD-domain-GUID" Get-SPOTenantSyncClientRestriction
This restriction relies on Active Directory domain membership; in an Entra-joined-only fleet, Conditional Access requiring a compliant device takes over.
Idle session sign-out
On a shared device, a session left open remains a risk. Idle session sign-out ends the web session after a defined period, with a warning beforehand. It applies to the browser and does not affect desktop apps.
Good habit. Test the user experience on an unmanaged device before enabling anything: a clear message explaining why downloads are blocked prevents an avalanche of helpdesk tickets.
Where to start
- Identify sites holding sensitive data and apply limited access to them first.
- Check that Conditional Access policies cover browsers, desktop clients and mobile apps.
- Restrict OneDrive sync to managed PCs.
- Enable idle session sign-out with a duration suited to how people work.