How to Prevent Specific Users from Syncing SharePoint Files
Question details
An organization needs to allow browser-based access to Microsoft 365 group files while preventing specific users, guests, or unmanaged devices from syncing complete libraries locally via OneDrive.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Administrators want to block local syncing for targeted users (like guests or people on personal devices) while retaining their online browsing capabilities, and ensure local copies are inaccessible after users leave.
- Observed behavior
- Currently, users with access can sync complete libraries locally. SharePoint does not offer a direct per-user setting to block OneDrive synchronization while maintaining web access.
Ensure you have SharePoint Administrator or Global Administrator privileges in your Microsoft 365 tenant, as modifying tenant-level sync policies requires executing PowerShell commands.
Restrict OneDrive Sync to Managed Domains via PowerShell
Prevent unmanaged devices (such as personal computers and guest devices) from syncing SharePoint libraries by restricting sync clients to trusted domains.
Because SharePoint lacks a per-user sync restriction that allows web access, the most effective method to target guests and personal devices is by restricting the OneDrive sync client to specific, managed domains.
Launch the SharePoint Online Management Shell as an administrator on your PC.
Run the command 'Connect-SPOService -Url https://[yourtenant]-admin.sharepoint.com' and log in with your global administrator credentials.
Execute the 'Set-SPOTenantSyncClientRestriction' cmdlet, specifying the allowed domain GUIDs. This ensures only devices joined to your trusted corporate domain can sync files locally.
Disable Sync at the SharePoint Site Level
Turn off the synchronization feature for entire SharePoint sites if you want to prevent all users from downloading libraries locally via the OneDrive app.
Configure Retention and Deletion Policies
Manage file access and ensure data is eventually removed from devices after a user leaves the company.
Use WPS Office for Secure and Lightweight Document Management
While Microsoft 365 requires complex PowerShell commands to manage local syncs and file access, WPS Office provides a lightweight, highly compatible alternative for your teams to view and edit documents securely. Easily handle Word, Excel, and PowerPoint files without the heavy overhead of enterprise sync clients.
- 1. Download the Installer: Visit the official WPS Office website and download the free software for your operating system.
- 2. Install WPS Office: Run the downloaded installer file and follow the quick on-screen instructions to set it up.
- 3. Open Your Files: Launch WPS Office and directly open your existing Word, Excel, or PowerPoint documents to start editing immediately.
Frequently Asked Questions
Can I block specific users from syncing SharePoint without blocking everyone?
SharePoint does not currently support per-user sync restrictions natively. You can only restrict sync at the tenant level (by blocking unmanaged devices/domains) or at the site level for all users.
How do I stop external guests from syncing SharePoint libraries?
The most effective method is to use the Set-SPOTenantSyncClientRestriction PowerShell cmdlet. By specifying your trusted corporate domain, external guests on unmanaged devices will be blocked from using the OneDrive sync client.
Does disabling sync at the site level prevent users from downloading individual files?
No. Disabling the site-level sync prevents users from using the OneDrive app to sync entire libraries locally, but they can still manually click 'Download' on individual files from the web browser unless additional Conditional Access policies are applied.
What happens to locally synced files when a user leaves the company?
Once a user's account is disabled and their access is revoked, the OneDrive client will stop syncing. However, offline files already downloaded to unmanaged devices may remain. Using retention policies and endpoint management (like Intune) is recommended to wipe corporate data remotely.
