Conditional Access and unmanaged devices

The problem it solves

Blocking unmanaged devices outright kills legitimate BYOD and guest work; allowing them fully lets corporate files sync and download to machines you don't control. Conditional Access (CA) with app-enforced restrictions gives a middle tier: the user gets in via the browser only, with download, print and sync disabled, so they can read and edit in place but can't take the data off the device.

How it's wired (two halves that must meet)

The posture requires BOTH:

1. SharePoint side — Set-SPOTenant -ConditionalAccessPolicy with:
   • AllowFullAccess — no restriction.
   • AllowLimitedAccess — the browser-only, no-download/print/sync mode.
   • BlockAccess — deny. You can also set this per-site (Set-SPOSite -ConditionalAccessPolicy), so a sensitive site is limited-access while the tenant is full.
2. Entra side — a Conditional Access policy targeting Office 365 SharePoint Online as the app, with a session control ("Use app-enforced restrictions") and a condition that identifies the device as unmanaged (device not compliant / not hybrid-joined).

SharePoint enforces the limited experience only when Entra signals the session matches. One half without the other does nothing.

Related levers

• Idle-session sign-out for unmanaged browsers (Set-SPOBrowserIdleSignOut).
• IP-based access — Set-SPOTenant location boundary / CA named locations to confine access to trusted networks.
• Authentication context — bind especially sensitive sites to a step-up (MFA / compliant device) via a labelled auth context.

The failure modes

• Only half configured. Setting AllowLimitedAccess in SPO without the Entra CA policy (or vice versa) leaves the restriction inert — the classic "we turned on block-download and nothing changed".
• Browser-only means browser-only. App-enforced restrictions govern the web experience; the interplay with Teams/Office desktop clients differs and needs its own CA controls — assuming the desktop app is covered is a gap.
• Download block ≠ no exfiltration — a user can still copy text on screen or screenshot; limited access reduces bulk exfiltration, it isn't DRM (that's encryption/labels).
• Guest impact — limited-access policies can unexpectedly clamp legitimate guest work; scope carefully.
• Per-site vs tenant precedence — the more restrictive of tenant and site applies; a full-access tenant with a limited site still limits that site.

What to watch (proofs)

• SPO stance: Get-SPOTenant | fl ConditionalAccessPolicy, LimitedAccessFileType and per-site Get-SPOSite <url> | fl ConditionalAccessPolicy — the SharePoint half.
• The Entra half: the Conditional Access policy targeting SharePoint with the app-enforced-restriction session control — proof both halves meet.
• Idle sign-out: Get-SPOBrowserIdleSignOut — is the unmanaged-browser timeout on?
• Live test: sign in from an unmanaged browser — the download/sync/print options should be greyed out and a banner shown; that's the enforcement proof.