Conditional Access enforces app-enforced restrictions

​

What this check verifies

Microsoft Entra Conditional Access policy with application enforced restrictions limits access to SharePoint, OneDrive, and Exchange content from unmanaged devices. This control helps prevent data exfiltration by restricting download, print, and sync capabilities on devices that are not managed by the organization.

​

Risk

Without application enforced restrictions, users accessing SharePoint, OneDrive, and Exchange from unmanaged devices can:

• Download sensitive files to personal devices
• Print confidential documents
• Sync corporate data to uncontrolled locations

This increases the risk of data leakage and unauthorized access to sensitive information.

​

Recommendation

Configure Conditional Access policies with application enforced restrictions to control access from unmanaged devices. Apply this to Office 365 applications (SharePoint, OneDrive, Exchange) to limit download, print, and sync operations. Combine with SharePoint access control settings for comprehensive protection.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
2. Expand Protection > Conditional Access and select Policies.
3. Click New policy.
4. Under Users, select All users.
5. Under Target resources, select Office 365 from the cloud apps.
6. Under Conditions > Client apps, select All client apps.
7. Under Session, check Use app enforced restrictions.
8. Set the policy to On and click Create.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-policy-app-enforced-restriction
• https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_app_enforced_restrictions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks