Can You Create Multiple SharePoint Online Subdomains?
Question details
The user needs to set up separate SharePoint environments for internal and external users while restricting access to specific company proxy IP addresses.
- Product
- SharePoint Online
- Device & OS
- not provided
- Scenario
- Segregating internal and external user access by attempting to create different subdomains and applying IP-based access restrictions.
- Observed behavior
- SharePoint Online does not allow the creation of multiple domain names or subdomains within a single tenant to split user traffic.
Ensure you have Global Administrator or SharePoint Administrator privileges in your Microsoft 365 tenant to configure site permissions and Microsoft Entra ID Conditional Access policies.
Use Separate Sites and Conditional Access Policies
Since multiple subdomains are not supported, you should create separate SharePoint sites and control access using strict site permissions combined with network-based Conditional Access.
SharePoint sites cannot be created with different domain names under the same tenant. Furthermore, the primary tenant SharePoint domain can only be changed once. To achieve the separation of internal and external users, administrators must use distinct site collections on the same domain and secure them via Microsoft Entra ID.
Navigate to the SharePoint Admin Center and create distinct site collections—one dedicated to internal employees and another for external users.
Assign access rights so that internal Microsoft 365 groups only have permission to the internal site, and external guest users are only granted access to the external site.
Log in to the Microsoft Entra Admin Center, go to Security > Conditional Access > Named locations, and add your company's proxy IP addresses as a trusted IP range.
Create a new policy targeting the 'SharePoint Online' cloud app. Under the 'Conditions' tab, configure 'Locations' to restrict access so that specified internal users can only log in from the trusted proxy IP addresses.
Looking for a Lightweight Alternative to Microsoft Office?
Managing complex Microsoft 365 environments and SharePoint permissions can be time-consuming. If your team simply needs a powerful, easy-to-use office suite for creating and collaborating on documents without the heavy enterprise administration, WPS Office is an excellent free alternative.
Frequently Asked Questions
Can I change my SharePoint Online tenant domain name?
Yes, Microsoft allows you to rename your SharePoint Online tenant domain, but this action can only be performed once per tenant. You cannot maintain multiple active domain names simultaneously.
How do I restrict SharePoint access to specific IP addresses?
You can restrict access by setting up a Conditional Access policy in Microsoft Entra ID. First, define your approved IP addresses under 'Named locations', then apply a policy to the SharePoint Online app that blocks access from any location outside those trusted IPs.
Can I block a user from specific SharePoint sites using Conditional Access?
No, Conditional Access policies apply to the entire SharePoint Online cloud app for a given user. To block a user from a specific site while allowing access to others, you must modify the site-level permissions rather than using Conditional Access.
