We have a serious issue to secure Sharepoint Online.

We require (and configured) the use of MFA with the Authenicator-app or sms. We have configured sign out inactive users and don't give the option to remain signed in. SharePoint must enforce these

This is important for us because we have to support unmanaged client devices, users don't logon on to their device and share their device like internet cafe PCs.

This all works very well in a browser based environment.

If a user is authenticated and authorized with his browser to SharePoint, he is able to open a sharepoint managed document with his local Office app (Word). Once he does this his account and credentials are added to Connected Service on the local machine.

Never is asked for the MFA verification, inactive users are never signed off, so every user who has access to this unmanaged machine has access to or documents on SharePoint Online.

We cannot believe that this is by design, what should be done that MFA, sign out inactive users is effective for these users too. Please help, we can't go live with this serious security issue.

1 Answer 1


I suggest you control access from unmanaged devices.

Users on unmanaged devices will have browser-only access with no ability to download, print, or sync files. They also won't be able to access content through apps, including the Microsoft Office desktop apps.

Control access from unmanaged devices

  • Do you say that a Office 365 E1 license is not enough to use it because some Internet Cafe user can pass by the security rules we have defined? This would make the E1 license useless and that cannot be.
    – JSface
    Nov 12, 2019 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.