# Application Enforced Restrictions For Unmanaged Devices. > This Conditional Access Policy blocks or restricts access to SharePoint, OneDrive, and Exchange content from unmanaged devices. This Conditional Access Policy blocks or restricts access to SharePoint, OneDrive, and Exchange content from unmanaged devices. It helps prevent data leakage by ensuring that only managed and compliant devices can access sensitive organizational data. ## Settings this baseline controls | Setting | What it does | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Policy name | Specifies a display name for the Conditional Access Policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Enable policy | Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Included users | User IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Included roles | Role IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Included groups | Group IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Included guest types | Guest or external user types in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Excluded users | User IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Excluded roles | Role IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | **4 more settings** | Setting | What it does | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Excluded groups | Group IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Excluded guest types | Guest or external user types excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Included applications | The list of client IDs (appId) the policy applies to, unless explicitly excluded (in excludeApplications) All, Office365 - For the list of apps included in Office365. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | | Use app-enforced restrictions | Session control to enforce application restrictions. Only Exchange Online and Sharepoint Online support this session control. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-app-enforced-restriction) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this baseline when you want unmanaged devices to get a cut-down experience in SharePoint Online and Exchange Online, rather than blocking them outright. 1. Add the baseline to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or carry it in a scheme you deploy to every tenant you manage (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Included users** covering everyone, and use **Excluded users** or **Excluded groups** for your organisation's break-glass accounts. 3. Leave **Included applications** set to Office 365. This session control works only with SharePoint Online and Exchange Online, so a wider application scope has no extra effect. 4. Leave **Use app-enforced restrictions** switched on. This setting tells SharePoint Online and Exchange Online to pass device information and cut down the experience on an unmanaged device; without it, the policy matches sign-ins but changes nothing. 5. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply the policy whenever it's changed in Microsoft 365, so unmanaged devices keep the reduced experience without anyone having to spot the change. > **Licence: Entra ID P1 or P2:** This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated — see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/). ## Check it worked After the next sync, this baseline shows **Passing** once a policy with `state` set to `enabled` and app-enforced restrictions turned on exists in Microsoft Entra. You can confirm it in the Microsoft Entra admin centre under **Entra ID > Conditional Access > Policies**. On an unmanaged device, end users get a limited view in Outlook on the web and SharePoint (no download, print or sync) rather than being blocked; on a managed, compliant device they see no change. ## Standards this addresses ### CIS - **M365 5.2.2.x** — CIS M365 Foundations Benchmark 5.2.2.x - **v8 6.4** — CIS Controls v8 Safeguard 6.4 - **v8 3.3** — CIS Controls v8 Safeguard 3.3 ### NIST - **PR.AC-7** — NIST CSF 2.0 PR.AC-7 - **SC-7** — NIST SP 800-53 SC-7 - **CM-7** — NIST SP 800-53 CM-7 ### ISO 27001 - **A.8.3** — ISO/IEC 27001:2022 Annex A.8.3 - **A.8.22** — ISO/IEC 27001:2022 Annex A.8.22 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)