Conditional Access Problems

Fix External OneDrive Downloads Blocked by Conditional Access

Khadija Khan Sep 25, 2026 869 views

Question details

External recipients are unable to download, print, or sync shared OneDrive files after Conditional Access policies were applied to unmanaged devices.

How to Fix External OneDrive Downloads Blocked by Conditional Access

Product: Microsoft OneDrive and Entra ID
Device & OS: not provided
Scenario: Sharing files externally via OneDrive links with Conditional Access enabled.
Observed behavior: External users can sign in and view shared files online through shared links, but all download, print, and sync functionalities are blocked by policy restrictions.

Before you start

Ensure you have Global Administrator or Conditional Access Administrator privileges in Microsoft Entra ID (formerly Azure AD) to view, simulate, and modify security policies.

Solution 1Recommended

Review and Adjust Conditional Access Session Controls

Check Microsoft Entra ID for session controls that specifically block downloads for external users on unmanaged devices.

Conditional Access can use 'App enforced restrictions' or 'Conditional Access App Control' to restrict what external users can do when accessing SharePoint and OneDrive from unmanaged devices.

Access Conditional Access policies

Identify the restrictive policy

Locate and open the policy that targets 'Guest or external users' and applies to 'Office 365' or 'SharePoint' cloud apps.

Check session controls

Under the 'Session' section, check if 'Use app enforced restrictions' or 'Use Conditional Access App Control' (with Block Downloads enabled) is selected.

Modify the assignments

Adjust the policy to exclude specific external guest users if necessary, or modify the restriction level. Save the changes and wait for them to propagate.

Review and Adjust Conditional Access Session Controls

Policy Propagation Time: Changes to Conditional Access policies can take anywhere from a few minutes to up to 24 hours to fully propagate and apply to existing active sessions.

Solution 2

Use Policy Simulation to Identify Blocking Policies

Utilize the 'What If' tool in Entra ID to pinpoint exactly which policy is enforcing the download block on the specific external user.

Solution 3

Escalate to Microsoft Support

If adjusting policies does not resolve the download restrictions after allowing adequate time for propagation, open a support ticket via the admin center.

Free Microsoft Office alternative

Try WPS Office for Seamless Document Management

While enterprise security policies like Conditional Access in Microsoft 365 can sometimes complicate external file sharing, WPS Office provides a robust, lightweight alternative for creating, editing, and sharing documents locally or via simpler cloud solutions without complex admin constraints.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight software that installs quickly on nearly any device or operating system.Free to use with a familiar, user-friendly tabbed interface for seamless migration.Built-in PDF editing, conversion, and smooth local file management tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why can external users view but not download my shared OneDrive files?

This typically happens when Conditional Access policies in Microsoft Entra ID are configured to enforce 'block download' session controls for unmanaged devices, or when SharePoint tenant-level settings restrict external sharing permissions.

How long does it take for Conditional Access policy changes to apply?

Policy updates in Microsoft Entra ID usually take effect within 15 to 30 minutes for new sign-ins, but existing session tokens might take longer to refresh. It is recommended to have the external user sign out, clear their browser cache, and sign back in.

Can I apply Conditional Access policies only to internal users?

Yes. You can customize the 'Users and groups' assignments within your Conditional Access policy to target specific internal user groups or directory roles, while explicitly excluding 'Guest or external users' to bypass these restrictions for shared links.

Microsoft Office Security Issues