Forum Discussion
Block upload of documents to other office 365 tenant
I wish to block upload of documents to Other Office 365 tenant on a managed device?
Can this be achieved using MCAS
- Is it a specific M365 tenant you want to block uploads to, or any/all other tenants? And do you want to block uploads to other M365 tenants but allow uploads to other services, or block all uploads?
- We want to block upload to all other office 365 instance apart from the one we own.
Do you mean sharing documents with other tenants? because upload means they already have access to those tenants as guests maybe and the other tenants should take the action from their sides not yours.
If you're talking about sharing files with another domains/tenant, as i know you can get prevent that using a File Policy in MCAS
Also you can use entire organization instead of Any Any from domain.
Cheers,
- I think the issue with that file policy is that you have to specify the domain you’re wanting to block. That would not be possible if you’re wanting to block a domain that’s M365 registered.
My feeling is, the easiest solution would in fact be to encrypt data and have less focus on where the data is going.
You could also use a simple conditional access policy to block auth from unmanaged devices or only allow with from trusted locations. This means even a user in the source tenant can’t take the data away from a managed device and access it - their auth would be blocked by the conditional access policy.
Ultimately, there are a number of ways of preventing data being accessed outside the source tenant. I don’t believe blocking upload to “any M365 tenant” is a realistic option.
Encryption covers many vectors. Upload to any M365 tenant doesn’t even cover all vectors and would be hard / impossible to manage.- To be clear. You’d have to list every M365 registered domain in the file policy. That would be millions of domains. I don’t think the policy supports that many domains, and I don’t know how you could possibly ascertain a list of all domains that are M365 registered even if it does support that many domains.
- Hello,
I am not talking about sharing or collaborating here, I am talking about upload.
on my corporate device, i can log in to any office 365 tenant and upload documents of my tenant, i want to restrict to only single tenantThis is not even related to uploading or sharing files, if you don't want your corporate devices access to other tenants you need to use Azure AD tenant restrictions, take a look here.
I hope this will be helpful.
