Keeping corporate data secure is a constant challenge. Letting employees view documents on a personal device is often fine, but allowing them to download sensitive spreadsheets or customer records to an unmanaged desktop creates a significant risk of a data leak.

Fortunately, Microsoft 365 offers a clever middle ground. Rather than completely blocking access for personal devices, you can allow “limited access”. This lets users view and edit documents right inside their web browser, while preventing them from downloading, printing or syncing files locally.

Here is a simple, step-by-step guide on how to configure this in your tenant.

What You Need Before Starting

Before diving into the setup, make sure you have the following requirements covered:

  • Licensing: You need a Microsoft Entra ID P1 or P2 licence (included with plans like Microsoft 365 Business Premium, E3 or E5).
  • Admin Roles: You will need to be a Sharepoint Admin or a Global Administrator to make these changes.
  • Device Setup: This rule specifically targets unmanaged devices (devices that are not enrolled in Microsoft Intune or joined to your hybrid entra ID).

Method 1: SharePoint Admin Centre

If you want a quick setup without messing around with custom conditional access rules, Microsoft has a standard setting directly in the admin centre. When you turn this on, it automatically creates the necessary backend rules for you.

  1. Head over to the Sharepoint Admin Centre and sign in with your admin account.
  2. In the left hand navigation menu, expand Policies and select Access control.
  3. Look for the Unmanaged devices option at the top of the page.
  4. Select Allow limited, web-only access, then click Save.

That is literally all it takes. Once saved, any user connecting from an unmanaged laptop or phone can preview files in Office for the Web, but the download, print, and sync buttons will disappear or show an access warning.

Method 2: Conditional Access Policy

If you want tighter control such as applying this restriction only to specific departments, or setting up explicit exclusions, you can build a custom policy using Conditional Access .

Here is how to set it up manually!

Step 1: Create the policy

Open the Microsoft Entra Admin Centre , navigate to Entra ID > Conditional Access and select Create new policy.

Step 2: Target Users and Exclude Admins

Name the policy, then under Users, select the specific users or groups you want this policy to apply to.

Under the Exclude tab, exclude global admin accounts and break-glass accounts as required.

Step 3: Choose Resources (cloud apps)

Under Target resources, select Resources (formerly cloud apps), choose Select resources > Select specific resources and search for Office 365. Choosing Office 365 rather than sharepoint is usually the safest option because it covers underlying app dependencies.

Step 4: Configure Conditions

Under Conditions, set Client apps to Yes and select client apps as required from the list.

Step 5: Enforce App Restrictions

Under Session at the bottom of the policy settings, check the box for Use app enforced restrictions. This tells sharepoint and Exchange to pass device state signals over to the browser session.

Step 6: Test and Enable

Set the policy switch at the bottom to Report-only mode first. This lets you test the policy in your audit logs without affecting users. Once you verify that it functions as expected, switch it to On and save.

Try starting with Method 1 to see how your team adapts, then move to Method 2 if you need tailored rules for specific business units.

Preventing unmanaged devices from downloading files in sharepoint is a simple but effective way to reduce the risk of sensitive data ending up on devices you don’t control. This approach still lets users access sharepoint and other microsoft 365 services when they need to, while adding an extra layer of protection around your data. Before rolling the policy out across the organisation, it’s a good idea to test it with a small group of users first and make any necessary adjustments. It’s also worth reviewing the policy from time to time to make sure it still fits your organisation’s security needs.