Question around blocking unmanaged device access M365
Posted by Blade4804@reddit | sysadmin | View on Reddit | 7 comments
Curious how others are handling this because I’m running into a wall.
Goal is pretty standard: allow browser access to M365 from unmanaged devices but block downloads (SharePoint, OneDrive, Office web apps, etc). Easy enough with SharePoint unmanaged device controls + CA.
Problem is Power BI.
As soon as you enforce web-only / no-download on SharePoint, scheduled refreshes that pull from SharePoint start failing. Auth succeeds, but the data call gets blocked and shows up as “invalid credentials.”
I’m trying to avoid carving out user/service account exceptions or redesigning the data source just to make this work.
So… how are you all dealing with this?
• Accept the limitation?
• Move data sources off SharePoint?
• Just live with exceptions?
Feels like a pretty common scenario but the controls don’t quite line up.
Curious what others landed on.
I was going to post this into /microsoft365 but the posts don’t read technical there so hoping this group can help better.
Yes I used AI to help write the question.
Elensea@reddit
Definitely set it up as you did but run power automate flows through a service account that is immune from this CA. You can lock it down to trusted ip if really concerned.
Blade4804@reddit (OP)
I tried adding trusted IP as an exclusion but the auth is tied to the initial setup IP. Which we are split tunneling all m365 to avoid von throttling.
Using service accounts costs extra licenses but maybe a cheap F3 is the cost of doing business securely
bjc1960@reddit
F3 is for mobile devices 10.9 and below We have a Power BI license for the Service Account. That is the price of "one glass of wine" at a 100+ glass executive dinner.
SlapcoFudd@reddit
Have you considered a service account for this? I also didn't read the other comments in the thread.
Blade4804@reddit (OP)
We have but it would require licensing. But it seems this is the way that’s most secure.
Master-IT-All@reddit
I would create a SOP for service accounts and exceptions.
You already know the answer.
disposeable1200@reddit
Service accounts should be isolated from this and have other protections and monitoring in place.
In Entra they should probably be app registrations using keys where possible ...