How to restrict OneDrive sync to managed devices

What this check looks at

Checks whether the OneDrive sync client is restricted to devices joined to the domain or managed.

The OneDrive sync app copies SharePoint libraries and OneDrive folders onto a computer’s disk and keeps them in step. By default it works on any Windows or Mac computer where someone signs in with their work account, including a personal laptop or a family PC. SharePoint’s "Allow syncing only on computers joined to specific domains" (Set-SPOTenantSyncClientRestriction, read in Microsoft Graph as isUnmanagedSyncAppForTenantRestricted) limits the Windows sync app to computers joined to the Active Directory domains you list by GUID, and can block sync on Macs.

The check fails when the restriction is off and passes when it is on; it reports not checked when the value was not returned. Because the restriction works on Active Directory domain membership, it fits organisations whose Windows computers are domain joined or Microsoft Entra hybrid joined. For computers that are only Entra joined, the usual protection is a Conditional Access policy requiring a compliant device; that protects the data but does not change this setting, so the check keeps reporting it.

A synced library is a full local copy. On a personal machine the business cannot enforce encryption, updates or antivirus, cannot wipe the files when the person leaves, and cannot see what happens to them next: copied to a USB stick, backed up to a personal cloud, or reached by whatever malware is on a family PC. One person can sync tens of thousands of files in minutes, which makes this the quietest bulk exfiltration route in Microsoft 365.

Why it matters

Unrestricted sync lets a user pull an entire document library onto a personal machine you cannot wipe, patch or audit. It is the quietest large-scale data exfiltration path in Microsoft 365.

A typical case: a sales director about to join a competitor syncs the Sales and Clients libraries to their home iMac in their last week. The audit log shows nothing more than sync activity, and after they leave the business can neither get the files back nor prove exactly what was taken, short of expensive legal action.

The reverse also happens: ransomware on a home PC encrypts the synced files, and the encrypted copies sync back to SharePoint. Version history can restore them, but only after a disruptive recovery. Under Cyber Essentials, a personal device that reaches organisational data is in scope and must meet the same controls; keeping unmanaged computers to browser access makes that boundary far easier to hold.

CIS Microsoft 365 Foundations Benchmark 7.3.2 asks that OneDrive sync is restricted for unmanaged devices. It supports ISO 27001 A.8.1 (user endpoint devices) and the NCSC Cyber Assessment Framework’s B3.d on data on mobile devices.

How to fix it

Where: SharePoint admin centre → Settings → Sync

Before you start

• Find the domain GUIDs of your on-premises domains (for hybrid joined devices), and make sure company Windows devices are joined.

Step by step

1. 1Find your Active Directory domain GUIDs. On a domain-joined computer with the Active Directory PowerShell module, run Get-ADDomain | Select-Object Name, ObjectGUID for each domain your company computers are joined to, and note the GUIDs.
2. 2Check company computers are joined. In the Microsoft Entra admin centre, go to Entra ID > Devices > All devices and look at the Join type column: company Windows computers should be Microsoft Entra hybrid joined (or domain joined). Any that are not will lose sync when the restriction goes on.
3. 3Tell users. Let staff know that from the change date OneDrive sync works only on company computers, and that on personal machines they can still use OneDrive and SharePoint in the browser.
4. 4Turn on the restriction in the SharePoint admin centre. In the SharePoint admin centre, go to Settings and select Sync (under OneDrive). Tick "Allow syncing only on computers joined to specific domains", enter the domain GUIDs, and select Save.
5. 5Or turn it on in PowerShell, blocking Mac sync too. Connect with SharePoint Online PowerShell as a SharePoint Administrator: Connect-SPOService -Url https://<tenant>-admin.sharepoint.com. Run Set-SPOTenantSyncClientRestriction -Enable -DomainGuids "<guid1>; <guid2>" -BlockMacSync:$true. Leave out -BlockMacSync if company Macs need to sync.
6. 6For Entra-joined-only computers, add Conditional Access. Where company computers are only Entra joined, create a Conditional Access policy in the Entra admin centre (Entra ID > Conditional Access > Policies > New policy): all users except your emergency access accounts, target resource Office 365 SharePoint Online, condition Client apps set to Mobile apps and desktop clients, grant "Require device to be marked as compliant". Start in Report-only and turn it on after checking the sign-in logs.
7. 7Confirm the change. Run Get-SPOTenantSyncClientRestriction: TenantRestrictionEnabled should be True with your GUIDs in AllowedDomainList. On a personal computer, signing in to the OneDrive sync app with a work account shows that syncing is not allowed.

What users will notice

OneDrive sync works only on company devices. Personal computers can still use OneDrive in the browser.

How to confirm it worked

SharePoint admin centre, Settings, OneDrive sync: "Allow syncing only on computers joined to specific domains" is on.

Frameworks and controls

This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Allow syncing only on managed devices (Microsoft Learn)

Related checks

• SharePoint and OneDrive external sharing: the safe setting
• Block legacy authentication to SharePoint and OneDrive
• DLP across email, SharePoint, OneDrive, Teams and devices
• Safe Attachments for SharePoint, OneDrive and Teams

The full Microsoft 365 security checklist, worst first