Conditional access policy for Unmanaged devices Sharepoint Online

Question

I am confused with the Conditional Access Policy settings. In SharePoint Admin the setting is 'AllowLimitedAccess' for unmanaged device, when I run this command Get-SPOTenant | Select-Object -ExpandProperty ConditionalAccessPolicy, I am getting again 'AllowLimitedAccess', but when I am retrieving all sites with the command Get-SPOSite -Detailed, every site has 'AllowFullAccess' setting for Conditional Policy. Also, only few sites are shared externally. Can someone please make me understand?

Answer 1

First of all, it will take 24 hours for this Conditional Access Policy to take effect. You can run the command again 24 hours after setting it up.

In addition,

Get-SPOTenant | Select-Object -ExpandProperty ConditionalAccessPolicy

This cmdlet returns Conditional Access Policy of organization-level site collection.

Get-SPOSite

This cmdlet returns Conditional Access Policy of a specific site collection.

The organization-level site collection conditional policy is the default policy that applies to all site collections in the tenant, unless they have a different policy set individually.

The site conditional policy is the policy that applies to a specific site collection, and it can override the organization-level policy if it is different.

For example, if the organization-level policy is AllowLimitedAccess, which means that users on unmanaged devices can only access SharePoint and OneDrive content in the browser and can’t download, print, or sync files, then this policy will apply to all site collections in the tenant. However, if you want to allow full access for a specific site collection, you can use the Set-SPOSite cmdlet to set the site conditional policy to AllowFullAccess, which means that users on unmanaged devices can access SharePoint and OneDrive content without any restrictions. This will override the organization-level policy for that site collection only.