Data Protection with Guest Users in Microsoft 365 | Secure Device Access
Nick Ross · · Video and write-up
When it comes to data protection, we usually throw out all of our security protections when external collaboration and guest users are added to the mix. Guest users can:
- Download files locally
- Access sensitive documents on insecure devices
- Do not even need to prove their identity (by default, setting dependent)
In this article, I am going to share the top policy I configure to protect my data for secure guest access that actually requires the user to use only browser based access and prevents them from downloading documents locally.
Considerations with other policies
In a previous blog post (opens in new tab), I talked about the recommended policies to restrict access to only managed devices within the organization. The key thing to note is that if you do not exclude Guest users from those policies, its highly likely they will be blocked. This is dependent on a few different factors such as the types of links being shared with them (Anyone vs New and Existing Guest) and how they are accessing your tenant. (are they using a VPN, are they using CloudPC/AVD, are they using their own personal device). The highest probability is that they are using their own corporate or personal device which would prevent them from collaborating on documents being shared with them, access to shared Teams/document repositories, etc.
If we were to exclude them from the required managed device policy, I do not like to leave their access wide-open, hence the policies we are about to cover.
Requiring Authenticated Guest Access
When users share documents with SharePoint/OneDrive, the default settings in M365 create what is known as an anyone link. Anyone meaning users can share a link to access a corporate document that anyone in the world could access without verifying their identity. Imagine someone being able to access a sensitive corporate document from the outside as quickly as they can access Google search.
Within the SharePoint admin center, you can go to Sharing and see your default policies. Ideally, you can swap this to new or existing guest. With this setting in place, external users will have to register as a guest user within your organization before they can access a document that is shared with them. If this is set to Anyone, our policy to require managed devices would not impact these users but is not preferred from a data protection perspective so the recommendation is to change this setting.
End-User Impact × Just a word of caution here. You really want to be careful in enabling this setting. In most cases this will be a significant change to end-users and you will want to send out communications of the change before turning it on.
- Requires the user to specify email addresses of who they are sharing with.
- External User will need to accept invitation (they will get an email)
Restricting Access on Guest Device
The policy i am going to show you extends our protections further by restricting the Guest user from downloading files shared with them locally on their device. This provides both data exfiltration protection and ensures our corporate documents are not being downloaded to a device that has potentially been compromised with malware/ransomware/etc.
In the SharePoint Admin Center
Follow these steps: IT Admins – SharePoint and OneDrive unmanaged device access controls – SharePoint in Microsoft 365 | Microsoft Learn (opens in new tab)
In Entra
This setting creates two conditional access policies in Entra:
- Restricts Mobile Apps and Desktop client access to devices that are marked as compliant or are hybrid joined in Entra.
- Restricts Browser access for SharePoint Online to use “app enforced restrictions.” This is what is show in the above support article and helps us restrict access on unmanaged devices.
End-User Experience
Guest users will be prevented from opening documents shared with them on their desktop applications and they will see a banner message that prevents them from downloading the document locally.
Conclusion
Be very careful turning this setting on and understand the impacts to the organization. This setting is highly restrictive (not just for Guest) and needs to be communicated appropriately to the organization and end-users before going live.
Harden it once, then know it stays that way.
CloudCapsule scans 300+ Microsoft 365 security controls in about a minute, shows what to fix first, fixes findings at scale, and flags drift the day a setting changes.
No credit card required. Results in < 2 minutes.
Keep reading
How to Set Up Claude SSO with Microsoft Entra ID (10-Minute Guide)
TLDR: You can set up Claude single sign-on (SSO) with Microsoft Entra ID in about 10 minutes on a paid Claude Team or Enterprise plan. The process has three parts: verify your company domain in Claude, connect Claude to Entra through Claude’s guided setup, and control access by assigning users or groups in Entra. Once […]
How to secure Claude AI for your Business
An employee opens Claude on their laptop. It is free, it is fast, and within ten minutes they have pasted in a contract, a financial summary, and a list of customer records, all because they are trying to get their job done. No audit trail. No admin visibility. And depending on their account settings, that […]
How Attackers wiped 80,000 Devices in Microsoft 365
On March 11th, 2026, employees at Stryker began their day to blank screens. Within three hours, roughly 80,000 devices had been wiped across the company’s 61-country footprint. Not encrypted. Not ransomed. Erased. No malware was involved. An Iran-linked hacktivist group compromised an admin account and used Microsoft’s own Intune remote wipe capability to erase the […]