Limit-Access to all external users, how we can do this

Question

Inside SharePoint Admin center >> Access Control, we can define limit-access to unmnaged devices:-

 

but for a tenant i am working on, we want to do it in another way, instead of relying on the device if it is managed or unmanaged, to control this based if the user is internal or external. so can we do this? now inside this documentation, IT Admins - SharePoint and OneDrive unmanaged device access controls - SharePoint in Microsoft 365 | Microsoft Learn , they mentioned that we can restrict this based on user group:-

 

so this means if we automatically add any external users to a group , then we can define this group to only have limited-access will this work? so internal users even if they access from unmnaged devices will have full access since they are not inside the group?? i am not an administrator but rather a SharePoint developer. so if any one can help me achieving this inside AD if it is not possible inside SharePoint? first how we can automatically add any external users to a group , then how we can define this group to have limited-access??

 

Thanks

Answer 1

You could set conditional access policy to make external users limit access.

Require one of following licenses:

Microsoft Syntex - SharePoint Advanced Management

Microsoft 365 E5/A5/G5

Microsoft 365 E5/A5/G5/F5 Compliance

Microsoft 365 E5/F5 Information Protection and Governance

Office 365 E5/A5/G5

Steps:

1.Go to Microsoft Entra admin center -> Protection -> Conditional Access -> New policy.

2.Users and Groups -> Under Assignments, select Users section -> Choose Include -> Select users and groups, then select Guest or external users.

3.Cloud Apps -> Under Assignments, select Target resources section-> Choose Include -> All cloud apps.

4.Conditions -> Under Assignments, select Conditions -> Client apps -> Configure set Yes -> Only select browser.

5.Configure Access Controls -> Under Assignments, select Access controls, then select Grant -> Choose Grant access.

6.Enable the Policy -> Set the policy to On -> Click Create to activate the policy.

Reference:

https://learn.microsoft.com/en-us/entra/architecture/7-secure-access-conditional-access

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.