Is there any way to configure DLP or any other methods to restrict download of documents from a document library outside corporate computers in an organization?

1 Answer 1


I'd suggest looking into Information Rights Management settings for SharePoint. Please note that you need Azure RMS activated in order to use IRM (How to activate Azure RMS: https://docs.microsoft.com/information-protection/deploy-use/activate-service). Also I'm assuming you have global admin rights, otherwise you can't activate it without the help of someone who does.

IRM actually encrypts the documents with a shared key so that only authorized people can see them. The only problem with that is: they still can log on from any computer and view the files - so see below how one may overcome this.

I'd use Azure AD conditional access to restrict logins to specific devices. Read more about it here: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview The Azure AD conditional access policies are a Premium feature, so you need to purchase an Azure Premium P1 or P2 plan (available through the Office 365 Admin interface). Its a couple of dollars ($6 to $9 approximately) per user per month, but if your requirement is business critical it more than justifies the cost.

Alternatively you can also use SP Online IP address restrictions, see https://www.michev.info/Blog/Post/831/restrict-access-to-sharepoint-online-based-on-ip for more information on how to do this with powershell. But keep in mind that it has the disadvantage that someone has to continuously review IP changes and keep the list updated so that the users actually can login from company equipment - even from VPN!! - and they dont scream murder if they get access denied when they should have it :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.