How to check unmanaged device access in SharePoint Online

Before you start

Use an account with the SharePoint Administrator role. Get-SPOSite needs an account that's a SharePoint administrator and a site collection administrator. Blocking or limiting access relies on Microsoft Entra Conditional Access, which has licensing of its own. In PowerShell 7 the SharePoint Online Management Shell loads through Windows PowerShell, which the last line of the install block does.

The settings are read live, but a change can take up to 24 hours to apply and doesn't reach people already signed in on an unmanaged device. The setting covers SharePoint and OneDrive only. The examples read and export and change nothing; they never call Set-SPOTenant or Set-SPOSite.

Option 1

Check unmanaged device access with PowerShell

Install the module once, then connect, read the organisation's setting and each site's. Replace contoso with your tenant's name.

# Install once, if the module is not already installed.
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
# In PowerShell 7 only: load the module through Windows PowerShell.
Import-Module Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

$ErrorActionPreference = 'Stop'
Connect-SPOService -Url 'https://contoso-admin.sharepoint.com'
try {
    $organisation = (Get-SPOTenant).ConditionalAccessPolicy
    $report = foreach ($item in Get-SPOSite -Limit All) {
        # A list leaves this setting at its default, so read each site on its own.
        $site = Get-SPOSite -Identity $item.Url
        [pscustomobject]@{
            Url = $site.Url
            Access = $site.ConditionalAccessPolicy
            SameAsOrganisation = "$($site.ConditionalAccessPolicy)" -eq "$organisation"
            AllowEditing = $site.AllowEditing
            FileTypes = $site.LimitedAccessFileType
        }
    }
    $report = @($report | Sort-Object SameAsOrganisation, Url)
    Write-Output "Organisation setting: $organisation"
    if ($report.Count -eq 0) {
        Write-Output 'No sites were found.'
    } else {
        $report | Export-Csv -Path './unmanaged-access.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) sites written to unmanaged-access.csv."
    }
} finally {
    Disconnect-SPOService
}

The script prints the organisation's setting, AllowFullAccess, AllowLimitedAccess or BlockAccess, and writes 1 row for each site with its own, the sites set differently first. Microsoft says Get-SPOSite with -Limit leaves ConditionalAccessPolicy unfilled, which is why each site is read again by its address, and why the script is slow on a large tenant. To add OneDrives, add -IncludePersonalSite $true to the first Get-SPOSite.

Option 2

Check the setting in the SharePoint admin centre

1. Sign in to Access control in the SharePoint admin centre as a SharePoint Administrator.
2. Select Unmanaged devices.
3. Read which option is selected. Allow limited, web-only access or Block access means unmanaged devices are held back; the third option allows full access.
4. Leave the pane without selecting Save. Saving a limit or a block turns off the Conditional Access policies this page made before and makes a new one.

This shows the organisation's setting, not a site set on its own, which only PowerShell shows. Under the same Access control, Apps that don't use modern authentication is worth a look too: Microsoft recommends blocking those apps when you limit or block devices.

Common questions

Can people still download files with limited access?

Not from SharePoint itself: on an unmanaged device they get the browser only, with no download, print or sync. Anyone links aren't affected, though, so anyone holding one can still download the item. Turn Anyone links off on the sites you limit.

Does it cover Teams and the rest of Microsoft 365?

No. It covers SharePoint and OneDrive, so on an unmanaged device a person can still use a team's chat but loses its Files tab. For every app, use a Conditional Access policy for the Office 365 app instead. To review those, see how to export Conditional Access policies in Entra ID.

How is 1 site set more strictly?

With PowerShell or a sensitivity label, after a Conditional Access policy that uses app-enforced restrictions is made in the Entra admin centre. A site's setting must be at least as strict as the organisation's.