How to block access from unmanaged devices on SharePoint

Organizations use Microsoft SharePoint to store and share sensitive documents, collaborate on projects, and manage internal resources. However, allowing unrestricted access to SharePoint from personal or unmanaged devices can increase the risk of data leaks, unauthorized access, and compliance violations.

To improve security, Microsoft 365 administrators can restrict SharePoint access to managed devices only. This ensures that users can access organizational content only from devices that meet security requirements, such as being enrolled in Microsoft Intune or joined to Microsoft Entra ID.

In this guide, we will show you how to block access from unmanaged devices on SharePoint using Microsoft 365 and Microsoft Entra ID policies.

Why Block Access From Unmanaged Devices?

Restricting SharePoint access from unmanaged devices helps organizations:

• Protect sensitive business data
• Prevent unauthorized downloads
• Meet compliance requirements
• Enforce device security policies
• Reduce the risk of data breaches

Managed devices are typically:

• Microsoft Intune-enrolled devices
• Microsoft Entra ID joined devices
• Hybrid Azure AD joined devices
• Devices compliant with company security policies

How to Block Access From Unmanaged Devices on SharePoint

1. Sign In to the SharePoint Admin Center

You must have SharePoint or Global Administrator privileges to configure access policies.

1. Open a web browser.
2. Sign in to the Microsoft 365 Admin Center.
3. Expand Admin centers.
4. Select SharePoint.

This opens the SharePoint Admin Center.

2. Open Access Control Settings

1. In the SharePoint Admin Center, select Policies from the left pane.
2. Click Access control.
3. Locate the Unmanaged devices section.

This section controls how unmanaged devices access SharePoint and OneDrive.

3. Choose an Access Restriction Policy

Microsoft provides several options for unmanaged devices.

You can choose:

• Allow full access from desktop apps, mobile apps, and the web
• Allow limited, web-only access
• Block access

To completely prevent access:

1. Select Block access.
2. Click Save.

Once enabled, unmanaged devices will no longer be able to access SharePoint content.

4. Configure Device Compliance Policies in Intune

To ensure only approved devices can access SharePoint:

1. Open the Microsoft Intune Admin Center.
2. Navigate to Devices > Compliance policies.
3. Create or edit a compliance policy.

Examples include:

• Require device encryption
• Require a password
• Require antivirus protection
• Require OS version compliance

4. Assign the policy to users or groups.

Devices that fail compliance checks may be blocked from SharePoint access.

5. Create a Conditional Access Policy

Conditional Access provides more granular control over SharePoint access.

1. Open the Microsoft Entra Admin Center.
2. Navigate to:

Protection > Conditional Access

3. Click Create new policy.
4. Enter a policy name.
5. Under Users, select the users or groups to apply the policy to.
6. Under Target resources, choose:

• Office 365 SharePoint Online

7. Under Conditions, configure:

• Device platforms
• Locations
• Client apps

8. Under Grant, select:

• Require device to be marked as compliant

or

• Require Hybrid Azure AD joined device

9. Enable the policy.
10. Click Create.

This ensures only compliant devices can access SharePoint.

6. Test the Policy

After configuring the policy:

1. Sign in to SharePoint from a managed device.
2. Verify that access works correctly.
3. Attempt access from an unmanaged device.
4. Confirm that access is blocked or restricted as intended.

Testing helps ensure the policy behaves as expected.

7. Configure Limited Access Instead of Blocking (Optional)

If you do not want to block access entirely, SharePoint supports limited access mode.

With limited access:

• Users can view files in the browser
• Downloads are blocked
• Printing and syncing may be restricted

To enable it:

1. Return to SharePoint Admin Center > Policies > Access control.
2. Under Unmanaged devices, select:

Allow limited, web-only access

3. Save the changes.

This provides a balance between security and usability.

8. Monitor Access Logs

Administrators should regularly monitor access activity.

1. Open the Microsoft Purview Compliance Portal.
2. Navigate to Audit.
3. Search for SharePoint access events.
4. Review:

• Sign-in attempts
• Blocked access events
• Device compliance status

Monitoring helps detect unauthorized access attempts.

Best Practices for Managing SharePoint Access

To improve security further:

• Require Multi-Factor Authentication (MFA)
• Use Microsoft Intune for device management
• Regularly review Conditional Access policies
• Enable audit logging
• Restrict external sharing when appropriate

These measures provide additional protection for organizational data.

Conclusion

Blocking access from unmanaged devices on SharePoint is an effective way to protect sensitive business data and enforce security policies. By using SharePoint Access Control, Microsoft Intune compliance policies, and Conditional Access rules, organizations can ensure that only trusted and managed devices can access corporate resources.

Whether you choose to completely block access or allow limited web-only access, implementing these controls significantly reduces the risk of data leakage and helps organizations maintain compliance with security requirements.