'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Restrict Teams and Outlook to Web Access via Conditional Access
Question details
The user needs to restrict access to Microsoft Teams and Outlook to web browsers only for a specific organization, explicitly blocking the desktop and mobile applications.
- Product
- Microsoft Entra ID, Microsoft Teams, Microsoft Outlook
- Device & OS
- not provided
- Scenario
- A user holds accounts for two different companies and needs standard desktop access for one organization, but strictly browser-only access to Teams and Outlook for the second organization.
- Observed behavior
- By default, the user can log into the desktop and mobile clients for both organizations. The goal is to enforce a web-only access restriction for the target tenant without affecting the other.
Verify that your Microsoft tenant has the required Microsoft Entra ID P1 or P2 licenses, and test the policy with a small group of users before rolling it out organization-wide to prevent accidental administrator lockouts.
Create a Conditional Access Policy to Block Desktop and Mobile Apps
Use Microsoft Entra ID Conditional Access to explicitly block authentication requests originating from desktop and mobile client apps, leaving browser access unaffected.
Conditional Access policies allow administrators to enforce organizational security requirements based on user signals, applications, and device platforms. By targeting the 'Client apps' condition, you can prevent users from logging into the rich desktop and mobile applications of Office 365 services like Teams and Outlook, forcing them to use the web browser versions instead.
This policy is applied at the tenant level. When the user attempts to sign into your organization's tenant using the desktop client, the access is blocked, but they can still use the desktop app for their other organization's tenant.
Navigate to the Microsoft Entra admin center (entra.microsoft.com) and log in as a Conditional Access Administrator, Security Administrator, or Global Administrator.
On the left sidebar, expand 'Protection', click on 'Conditional Access', and then select 'Policies'. Click on 'New policy' to create a blank policy.
Name your policy. Under 'Assignments', click 'Users', select 'Include', and choose the specific users or groups you want to restrict to browser-only access.
Under 'Conditions', click 'Client apps'. Toggle 'Configure' to 'Yes'. Check the box for 'Mobile apps and desktop clients' and uncheck 'Browser'. Click 'Done'.
Under 'Access controls', click 'Grant'. Select 'Block access' and click 'Select'.
Set the 'Enable policy' toggle at the bottom from 'Report-only' to 'On', then click 'Create' to apply the restriction.
Looking for a Lightweight, Cost-Effective Office Suite?
While managing complex Microsoft 365 tenant restrictions and Conditional Access policies, you may realize that deploying bulky Office desktop applications to all users isn't always practical or cost-effective. WPS Office provides a powerful, free, and highly compatible alternative for users who need core productivity tools without the heavy overhead.
- 1. Download the installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the software: Run the downloaded installer and follow the simple on-screen instructions to set up the lightweight application.
- 3. Open and edit files directly: Launch WPS Office and immediately start opening, editing, and saving your Microsoft Word, Excel, and PowerPoint documents without formatting issues.
Frequently Asked Questions
Do I need a specific license to configure Conditional Access policies?
Yes, Microsoft Entra ID Conditional Access features require your tenant to have Microsoft Entra ID P1 or P2 licensing. Basic or free tiers do not support custom Conditional Access policies.
Will blocking desktop clients also block users on mobile devices?
Yes. If you select 'Mobile apps and desktop clients' in the policy conditions, users will be blocked from using native mobile applications like the Outlook or Teams apps on iOS and Android. They will have to log in through their mobile web browser.
How does this affect users who belong to multiple organizations?
Conditional Access policies are applied strictly at the tenant level. If you implement this policy in Tenant A, it will only block desktop access when the user authenticates against Tenant A. They can still use the desktop apps seamlessly for Tenant B.
Why can users still access the desktop apps immediately after the policy is created?
Conditional Access policies apply during authentication. If a user already has an active session token in the desktop app, they may not be blocked immediately. To enforce the policy right away, you can revoke the user's active sessions in the Microsoft Entra admin center, which will force them to re-authenticate.
