- Platforms
- WindowsmacOS
- Products
- Conditional AccessSharePointExchange OnlineIntune
- Result
- Unmanaged devices get browser-only access without downloads, compliant or hybrid joined devices get full access
Overview
Give unmanaged devices browser-only access to SharePoint and Outlook on the web, with no downloads or printing, and keep full access for managed devices.
Access to web resources like SharePoint Online or Exchange Online (Outlook on the web) can be allowed (the default), limited or blocked, depending on the device the user connects from (compliant, hybrid joined or unmanaged). Blocking access on unmanaged devices hurts productivity, while limited access reduces the risk of accidental data loss and keeps users productive.
Limiting or blocking access relies on Conditional Access. The session control Use app enforced restrictions turns on the limited experience in supported cloud apps (SharePoint and Exchange Online). Microsoft Entra ID passes the device state to these apps, so they know whether the connection comes from a compliant or hybrid joined device, and grant full access or limit it.
The browser matters: in an unsupported browser the experience is always limited, even on a managed device. On Windows use Microsoft Edge.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Entra ID P1 for Conditional Access, and Microsoft Intune Plan 1 for compliance | Licensing |
| Admin role | SharePoint Administrator and Exchange Administrator for the service settings | SharePointEntra roles |
| Conditional Access Administrator to review and edit the policies | Entra roles | |
| Intune | Compliance policies for the devices you manage with Intune (or Microsoft Entra hybrid joined devices) | Compliance |
| Security | Conditional Access session control Use app enforced restrictions | App enforcedTemplate |
| Microsoft | SharePoint Online Management Shell and Exchange Online PowerShell for the commands | SharePointExchange |
| Microsoft Edge on Windows, so managed devices get full access | Zero Trust |
Configuration
Turn on limited access in SharePoint and Exchange Online, then review the Conditional Access policies.
Turn on limited access in SharePoint
In the SharePoint admin center, go to Policies > Access control > Unmanaged devices and select Allow limited, web-only access (see unmanaged device access controls):
Or set it with SharePoint Online PowerShell:
Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccessTurn on limited access in Exchange Online
Turn on the feature for all users in the default Outlook on the web mailbox policy with Exchange Online PowerShell (see Conditional Access in Outlook on the web):
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -ConditionalAccessPolicy ReadOnlyNote: limited access in Exchange Online works only for users whose mailbox policy has ConditionalAccessPolicy set to ReadOnly or ReadOnlyPlusAttachmentsBlocked.
Update (October 2026): Outlook on the web mailbox policies also apply to the new Outlook for Windows, see Outlook on the web in Exchange Online.
Review the Conditional Access policies
When I turned on limited, web-only access in the SharePoint admin center in 2021, it created two Conditional Access policies for all users, with no exclusions:
- [SharePoint admin center] Use app-enforced Restrictions for Browser access: client apps Browser, session Use app enforced restrictions, grant access
- [SharePoint admin center] Block access from Apps on unmanaged devices: client apps Mobile apps and desktop clients, grant Require device to be marked as compliant or Require Microsoft Entra hybrid joined device
Microsoft recommends blocking apps on unmanaged devices whenever you limit browser access, which is why there were two policies. They are a good baseline for your own policies.
Edit the policies and, if needed, add Office 365 Exchange Online under the target resources (cloud apps):
Limited browser access is set under Session > Use app enforced restrictions and applies to the assigned users (all users by default):
Optionally also require multifactor authentication under Grant.
The second policy blocks apps such as OneDrive and Teams on devices that aren't compliant or hybrid joined:
- Require device to be marked as compliant
- Require Microsoft Entra hybrid joined device
Update (October 2026): manage the policies in the Microsoft Entra admin center under Entra ID > Conditional Access. Microsoft's docs now describe one policy that the SharePoint admin center creates for all users, and recommend also blocking apps that don't use modern authentication. You can also build the policy yourself from the app enforced restrictions template.
User Experience
Finally, open Outlook on the web and SharePoint from an unmanaged and a managed device.
Unmanaged devices: limited access
Outlook on the web from an unmanaged device, in any browser (Edge, Chrome, Firefox, Brave, Safari, Opera and so on):
The banner says that your organization doesn't allow you to download or print attachments from this device or browser.
A SharePoint Online site (*.sharepoint.com) from an unmanaged device shows a similar limited experience:
The banner says that you can't download, print or sync, and that you need a domain-joined or Intune-compliant device for these actions.
The same limited experience on other unmanaged devices, here macOS (1, Safari) and Linux (2, Firefox):
Client apps such as OneDrive and Teams are blocked on unmanaged devices by the policy Block access from apps on unmanaged devices:
Managed devices (Intune compliant or Microsoft Entra hybrid joined)
Outlook on the web from an Intune-compliant device in Microsoft Edge, with full access:
A SharePoint Online site from an Intune-compliant device in Microsoft Edge:
Full access is granted, so users can download and print files in Edge on a managed device. Teams and OneDrive are allowed on compliant or hybrid joined devices, as the app policy says.