Contractors on their own laptops: how to stop downloads, printing and sync in SharePoint

A situation many companies know well: external contractors work alongside the company’s own staff. Employees use company computers that the company manages; contractors work on their own laptops. Everyone needs the same documents in SharePoint and OneDrive: to read them, add to them, comment on them. But management doesn’t want the contractors downloading, printing or syncing files to their own machines. When the engagement ends, nothing from the company should be left lying around on someone else’s disk.

We get asked about this more often than you might expect. A contractor needs to work with your documents, not take them home. Microsoft 365 has a feature for exactly that, and it doesn’t require managing someone else’s laptop, remote wipe or installing anything on the contractor’s side. It does come with two traps that are easy to step into. We’ll cover both.

As of 11 November 2026. This article is based on Microsoft’s documentation as of that date. Microsoft adjusts Conditional Access settings regularly, so every step links to its source.

Why not manage the laptop

The first idea is usually “let’s put the contractors’ laptops into Intune”. With a contractor’s own computer that rarely makes sense: they don’t want another company managing a device they also use for other clients, and you don’t want to be responsible for their computer. It would also solve the wrong problem. Intune looks after devices; you want to look after files.

It’s better to turn the logic around. Your company’s devices (enrolled in Intune and compliant, or joined to your domain) get full access. Everything else is an unmanaged device and gets limited, browser-only access.

What limited, web-only access does

In the SharePoint admin centre, under Policies → Access control → Unmanaged devices, there is an option called Allow limited, web-only access. According to Microsoft’s documentation, a person on an unmanaged device then:

• can open files only in the browser,
• can’t download, print or sync them with OneDrive,
• can’t reach them through apps either, including desktop Word or Excel,
• sees a banner at the top of the site saying their access is limited.

Editing in the browser is allowed by default, so a contractor can still edit and comment on a document in Word for the web. If you want to go further, PowerShell offers two stricter options: -AllowEditing $false prevents editing Office files in the browser, and -ReadOnlyForUnmanagedDevices $true makes the whole site read-only. The restriction can apply to the whole organisation or only to selected sites or OneDrive accounts (Set-SPOSite … -ConditionalAccessPolicy AllowLimitedAccess).

For completeness, the other extreme: Block access lets an unmanaged device get as far as an error message. That’s useful for sensitive sites, not for people who are supposed to work with the documents.

What you need: licences

The restriction relies on Microsoft Entra Conditional Access, which requires a Microsoft Entra ID P1 licence.

Licence	Entra ID P1	Note
Microsoft 365 Business Basic	no	buy P1 separately
Microsoft 365 Business Standard	no	buy P1 separately
Microsoft 365 Business Premium	yes	plus Intune for your own company devices
Microsoft 365 E3 / E5	yes	E5 has P2, which includes P1

Sources: Microsoft 365 for business security overview and Microsoft Entra licensing.

A tip for contractors who don’t need desktop Office. An Entra ID P1 licence on its own isn’t enough — it has no mailbox, no Teams and no SharePoint; it’s an identity add-on. The minimum is Business Basic + Entra ID P1: email, Teams, SharePoint, OneDrive and Office on the web and on mobile (plan options). Compared with Basic, Business Premium adds the Office desktop apps, Intune and Defender for Office 365. For someone who may only reach your files through a browser from an unmanaged laptop, desktop Office is no use for your documents — desktop Word can’t open them anyway. Your own company devices, which get full access, do need to be enrolled in Intune, and Business Premium (or E3/E5) includes it.

Trap 1: the setting applies to everyone

This is where most mistakes happen. When you save the option in the SharePoint admin centre, new Conditional Access policies that apply to all users are created in Entra. Microsoft says so explicitly in the documentation. On top of that, every later save on that page disables the previous policies and creates them again — your customisations aren’t carried over.

In practice: until your own laptops are enrolled in Intune and compliant, the restriction hits your internal staff too — and your admins. For the similar blocking setup, Microsoft explicitly warns that it can cut you off from the SharePoint admin centre and recommends excluding admins from the policy.

Recommended approach:

1. Create a group called “Contractors” (an Entra security group) containing only the external contractors.
2. Turn the option on in the SharePoint admin centre, then straight away find the newly created policies in Entra admin centre → Conditional Access. You’ll recognise them by names such as “Use app-enforced Restrictions for browser access”.
3. Scope them to the Contractors group (Users → Include → select groups) and exclude your emergency admin account. Microsoft supports targeting selected users or groups — the restriction can be applied to all users or only to some users or security groups.
4. If you want to observe first, switch the policies to Report-only. The Entra sign-in logs will then show who the policy would affect, without restricting anyone. Only then switch it on for real.
5. Don’t click Save on the Unmanaged devices page again. Every save recreates the policies for everyone and your scoping disappears. Make changes in Entra.

This is our recommended approach, not the only one — and always test it with one contractor before rolling it out to all of them. If you’d rather have the policy under your control from the start, you can create it manually in Entra (target app Office 365 SharePoint Online, session control “Use app enforced restrictions”) and switch on the SharePoint side with PowerShell.

Trap 2: the workarounds people forget

The restriction applies to sign-ins through SharePoint and OneDrive. But there are routes around it that you need to close separately:

• “Anyone with the link” sharing. Anonymous links aren’t affected by Conditional Access policies — whoever has such a link can download the file. Microsoft recommends turning them off on sites where the restriction is on.
• Apps that don’t use modern authentication. Old clients (Office versions before 2013, some third-party apps) can’t enforce the restriction. Microsoft recommends also blocking Apps that don’t use modern authentication in the same Access control section.
• Email attachments. The restriction only covers SharePoint and OneDrive. If someone emails a contractor a document as an attachment, they can download it as normal. To cover email and Teams as well, you need a Conditional Access policy for the whole of Office 365 — and above all a company habit of sending links rather than attachments.
• Files in Teams. The Files tab in Teams is SharePoint, so the restriction applies there too. Teams chat, however, isn’t covered.

What to expect when you switch it on

• It takes effect within 24 hours. Microsoft notes that the policy won’t affect anyone already signed in from an unmanaged device — after switching it on, ask the contractors to sign out and back in.
• PDFs and images. In the default mode (WebPreviewableFiles), Microsoft warns that PDFs and images can produce unexpected “Access Denied” errors, because the browser may need to download them to display them. Test with the file types your contractors actually use.
• Your own people need a supported browser. Even on a managed device, users must use a supported combination of operating system and browser, otherwise they get limited access too.
• Images on site pages. Someone editing a site from an unmanaged device may not see images uploaded to web parts — Microsoft documents a workaround.

What this doesn’t solve

Let’s be honest: limited, web-only access prevents downloading, printing and syncing. It doesn’t stop someone copying content out by hand or photographing the screen. For most small businesses that’s exactly the right level — the goal is that whole folders don’t stay on someone else’s disk after the engagement ends, not to build a vault.

If you need more — for example blocking copying of text, or controlling downloads based on how sensitive a document is — look at Microsoft Defender for Cloud Apps and its session controls. It is licensed separately (or included in Microsoft 365 E5), though, and considerably more complex to set up.

How we handle it at EasyPortal 365

Setting up Conditional Access is a one-off job, but it breaks easily: someone creates an anonymous link, someone clicks Save on the wrong page. That’s why it pays to keep an eye on it.

• Atlas shows sharing and guests, finds “Anyone with the link” sharing and can remove it with a single plan — it first prepares what will change by reading only, and acts only once you confirm. It also shows devices from Intune and Entra ID, including non-compliant ones — in other words, your own people’s computers that would get limited access too.
• We’re happy to go through the setup with you as part of our services — from the contractor group and a Report-only test to checking that nothing gets around it.

Key takeaways

• Limited, web-only access is the right choice for contractors on their own laptops: they work with the documents, but don’t take them away.
• You need Entra ID P1 — included in Business Premium, E3 and E5, an add-on for Basic and Standard.
• By default the setting targets all users. Scope it to a contractor group, exclude your emergency admin and start in Report-only mode.
• Close the workarounds: anonymous links, old apps and email attachments.
• Allow up to 24 hours and test PDFs and images.

Sources

• IT Admins – SharePoint and OneDrive unmanaged device access controls (Microsoft Learn)
• Use app-enforced restrictions (Microsoft Learn)
• Block access to SharePoint for specific users (Microsoft Learn)
• What is Conditional Access? – License requirements (Microsoft Learn)
• Microsoft 365 for business security overview (Microsoft Learn)
• Microsoft Entra licensing (Microsoft Learn)
• Microsoft 365 and Office 365 plan options (Microsoft Learn)
• Conditional Access app control in Microsoft Defender for Cloud Apps (Microsoft Learn)