Inside SharePoint admin site , we can define that users from unmanageddevices will have limited access , as follow:-

enter image description here

this will affect all SharePoint sites and onedrivce sites for all external users.. but can we define that certain external users (individual users or inside security group) will have full access to the files, while other external users will have limited access?

  • As per my knowledge it may be impossible because this setting is organization-wide and no OOTB way to exclude some users. The conditional access policy applies to all users.
    – Allen_MSFT
    Feb 16 at 1:59
  • @Allen_MSFT ok thanks for the reply
    – John John
    Feb 16 at 7:31

1 Answer 1


It's not possible to do this, as the setting will apply at organization-wide (tenant) level, not user level. The screenshot says it all.

Conditional Access As for Conditional Access, I'll try my best to answer as I'm not very much expert in it. Indeed, that the setting will create a conditional access policy in Azure AD. Conditional Access

Talking about Conditional Access policy, it's another universe altogether, you could restrict on which groups can access SharePoint Online with specific type of devices, via browser, location, whether there's sign-in risk level imposed, and what client apps they're accessing. enter image description here enter image description here

But this will apply to ALL SharePoint Sites regardless.

As you can't granularly control the settings up to the site level, at least not directly/not so straightforward, in 2021 Microsoft introduces Authentication Context where the way apps authenticated can be separated based on different context.

Imagine your scenario, where you want external users access is limited, for a particular SharePoint site. You could set a site to have a different Authentication Context and sensitivity label, then attach this to the Conditional Access policy.

enter image description here

Another link you might want to read up: https://alberthoitingh.com/2021/07/01/authentication-context-and-sharepoint-online/, https://learn.microsoft.com/en-us/sharepoint/authentication-context-example.

I once tried this out with no success so far, time constraint, probably due to the policy sync between Security & Compliance node, SharePoint, and Azure AD Conditional Access policy, and my lack of knowledge in Security aspects of Office 365 (like I said earlier, it's another universe).

Apologies if this doesn't answer your question. If you register a M365 Developer tenant, you can do trial & error on your own time.

  • the settings inside SharePoint online admin center will create an azure Ad access policy that can be modified further.. so my question is mainly about modifying the AD access policy, i know the options from SharePoint admin center side is very limited, i hope you got my point.
    – John John
    Feb 16 at 7:54
  • See my additional answer above. Feb 16 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.