How to Apply IP Address Restrictions to a Specific SharePoint Online Site
Question details
The user wants to know if it is possible to restrict access to a specific SharePoint Online site based on IP addresses or network locations.
- Product
- SharePoint Online
- Device & OS
- not provided
- Scenario
- Configuring network-location access policies or restricted access control for an individual SharePoint site.
- Observed behavior
- The user needs to implement location-based security or group-based restricted access for a single SharePoint site rather than the entire tenant.
Before configuring access restrictions, ensure you have SharePoint Administrator or Global Administrator privileges in your Microsoft 365 tenant. Also, verify your organization's compliance requirements regarding location-based access and Microsoft 365 group memberships.
Configure Network Location-Based Access at the Tenant Level
Since SharePoint Online does not support IP address restrictions for individual sites, you must configure network location policies for the entire SharePoint and OneDrive tenant.
Network location-based access in Microsoft 365 is designed as a tenant-wide security measure. When you apply a location-based policy, it controls access to all SharePoint and OneDrive resources, rather than targeting specific individual group sites.
Sign in to the Microsoft 365 admin center as a Global Administrator or SharePoint Administrator, and navigate to the SharePoint admin center.
In the left navigation pane, expand 'Policies' and select 'Access control'.
Click on 'Network location' from the list of access control options.
Toggle on 'Allow access only from specific IP address locations' and enter the authorized IP addresses or ranges for your organization.
Click 'Save' to apply the network location policy across your entire tenant.
Restrict Access to a Specific Site Using Microsoft 365 Groups
While you cannot restrict by IP per site, you can limit a specific site's access exclusively to members of an approved Microsoft 365 group using Restricted Access Control.
Looking for a Lightweight Office Alternative?
While managing complex SharePoint access policies requires specialized Microsoft 365 administrative tools, WPS Office provides a powerful, free, and lightweight alternative for your daily document creation and editing needs.
- 1. Download and Install: Visit the official WPS website to download the free installation package tailored for your operating system.
- 2. Open Your Documents: Launch WPS Office and directly open your existing Microsoft Office files. All original formatting will be perfectly preserved.
- 3. Edit and Save Seamlessly: Use the familiar ribbon interface to edit your documents and save them locally, or export them seamlessly as PDFs.
Frequently Asked Questions
Can I block a specific IP address from accessing just one SharePoint site?
No, network location-based access policies (IP restrictions) in SharePoint Online are configured at the tenant level. They apply globally to all SharePoint and OneDrive resources, meaning you cannot target or isolate individual sites with IP rules.
How does restricted access control differ from IP address restrictions?
Restricted access control limits site access to specific user identities within an approved Microsoft 365 group, regardless of their physical location. IP restrictions block or allow access based entirely on the user's network location or IP address, regardless of their group membership.
Can site owners bypass restricted access control once it is enabled?
No. Once restricted access control is enabled by an administrator for a specific site, site owners are prevented from sharing the site or its content with anyone outside the approved Microsoft 365 group.
Do I need PowerShell to configure restricted access control?
Yes, while you can manage groups in the Microsoft 365 admin center, enabling the restricted access control feature for a specific SharePoint site typically requires using the Set-SPOSite cmdlet in the SharePoint Online Management Shell.
