Greetings, I need to achieve the below Goal but struggling to think of any other options to enable the desired behavior.
Tenant: Office 365 E3; SharePoint Online with 100+ sites and which currently has ‘Allow limited, web-only access’ enabled for unmanaged devices
Goal: Guests should be able to open and download documents on one of the sites.
Testing performed:
1. There a number of articles suggesting one can run Set-SPOSite -Identity [] -ConditionalAccessPolicy AllowFullAccess to enable full access on one site, those are misleading, what happens then is that all your SharePoint sites will be ‘unlocked’ to Full Access regardless what the GUI for Unmanaged Devices suggests and every new sites created will be unlocked as well.
To make this case work, the setting for unmanaged devices should be set to ‘Allow full access from desktop, apps, mobile apps…’, then run a script to lock all the existing sites (100+) back to ‘Allow limited, web-only access’ except for one site. All new or ‘to be created’ sites will also need to be scripted to maintain web-only access.
2. Exclude SharePoint security group from existing Conditional Access policies created for SharePoint or the ones that enforce web-only access. Excluding the security group or even guests and external users options do not work, i.e. the site in question remains in web-only mode.
I could not think of any other option, so #1 above remains the only valid one.
Has anyone come across the same requirement and how did you achieve it?
